← Volver a CVEs

CVE-2020-1737

HIGH

7.5

Descripcion

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Vector de ataqueLOCAL

ComplejidadHIGH

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/9/2020

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

redhat:ansible_engineredhat:ansible_tower

Debilidades (CWE)

CWE-22CWE-22

Referencias

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737(secalert@redhat.com)

https://github.com/ansible/ansible/issues/67795(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/(secalert@redhat.com)

https://security.gentoo.org/glsa/202006-11(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/ansible/ansible/issues/67795(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202006-11(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.