← Voltar para CVEs

CVE-2020-1737

HIGH

7.5

Descricao

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeHIGH

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado3/9/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

redhat:ansible_engineredhat:ansible_tower

Fraquezas (CWE)

CWE-22CWE-22

Referencias

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737(secalert@redhat.com)

https://github.com/ansible/ansible/issues/67795(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/(secalert@redhat.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/(secalert@redhat.com)

https://security.gentoo.org/glsa/202006-11(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/ansible/ansible/issues/67795(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202006-11(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.