SB2020041766 - Path traversal in ansible (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2020-10691)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists when extracting a collection .tar.gz file, the directory is created without sanitizing the filename when running ansible-galaxy collection install. A remote user can send a specially crafted HTTP request and overwrite any file within the system.

This vulnerability affects versions 2.9.x prior to 2.9.7.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=d94bd50429d04befe80c8f8583b81cabdb91b418
• https://git.alpinelinux.org/aports/commit/?id=d4da1926ae91c64e47306a32a4627148900ff3c8