CVE-2020-10691
CVE-2020-10691
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
CVSS 5.2 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
ansible
- Versions
- all ansible-engine versions 2.9.x prior to 2.9.7: Affected
No fix published
ansible Debian:12
- Affected ranges
- ECOSYSTEM: < 2.9.7+dfsg-1
Update to 2.9.7+dfsg-1
ansible Debian:13
- Affected ranges
- ECOSYSTEM: < 2.9.7+dfsg-1
Update to 2.9.7+dfsg-1
ansible Debian:14
- Affected ranges
- ECOSYSTEM: < 2.9.7+dfsg-1
Update to 2.9.7+dfsg-1
ansible PyPI
- Versions
- 2.9.0
- 2.9.0b1
- 2.9.0rc1
- 2.9.0rc2
- 2.9.0rc3
- 2.9.0rc4
- 2.9.0rc5
- 2.9.1
- 2.9.2
- 2.9.3
- 2.9.4
- 2.9.5
- 2.9.6
- Affected ranges
- ECOSYSTEM: ≥ 2.9.0a1, < 2.9.7
Update to 2.9.7
ansible PyPI
- Versions
- 2.9.0
- 2.9.1
- 2.9.2
- 2.9.3
- 2.9.4
- 2.9.5
- 2.9.6
- Affected ranges
- ECOSYSTEM: ≥ 2.9.0, < 2.9.7
Update to 2.9.7
ansible Ubuntu:Pro:20.04:LTS
- Versions
- 2.8.3+dfsg-1
- 2.8.6+dfsg-1
- 2.9.2+dfsg-1
- 2.9.4+dfsg-1
- 2.9.6+dfsg-1
- 2.9.6+dfsg-1ubuntu0.1~esm1
- 2.9.6+dfsg-1ubuntu0.1~esm2
- 2.9.6+dfsg-1ubuntu0.1~esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published