CVE-2020-1735Path Traversal in Redhat Ansible

CWE-22Path Traversal12 documents7 sources
Severity
4.6MEDIUMNVD
CNA4.2
EPSS
0.2%
top 63.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 16
Latest updateApr 7

Description

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:NExploitability: 1.5 | Impact: 2.7

Affected Packages7 packages

NVDredhat/ansible2.8.02.8.11+2
PyPIredhat/ansible2.7.0a12.7.18+2
Debianredhat/ansible< 2.9.7+dfsg-1+3
NVDredhat/ansible_tower3.3.53.4.5+3
CVEListV5red_hat/ansible2.7.x, 2.8.x, 2.9.x

Also affects: Debian Linux 10.0, Fedora 30, 31, 32

Patches

🔴Vulnerability Details

4
OSV
Path Traversal in Ansible2021-04-07
GHSA
Path Traversal in Ansible2021-04-07
CVEList
CVE-2020-1735: A flaw was found in the Ansible Engine when the fetch module is used2020-03-16
OSV
CVE-2020-1735: A flaw was found in the Ansible Engine when the fetch module is used2020-03-16

📋Vendor Advisories

2
Red Hat
ansible: path injection on dest parameter in fetch module2020-02-18
Debian
CVE-2020-1735: ansible - A flaw was found in the Ansible Engine when the fetch module is used. An attacke...2020

💬Community

5
Bugzilla
CVE-2020-27764 ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c2020-11-04
Bugzilla
CVE-2020-1735 ansible: path injection on dest parameter in fetch module [openstack-rdo]2020-02-27
Bugzilla
CVE-2020-1735 ansible: path injection on dest parameter in fetch module [epel-all]2020-02-20
Bugzilla
CVE-2020-1735 ansible: path injection on dest parameter in fetch module [fedora-all]2020-02-20
Bugzilla
CVE-2020-1735 ansible: path injection on dest parameter in fetch module2020-02-12
CVE-2020-1735 — Path Traversal in Redhat Ansible | cvebase