Описание
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
A path traversal flaw was found in ansible. The fetch module allows copying and overwriting files outside of the specified destination in the local ansible controller host by not restricting an absolute path. The main threat from this vulnerability is to data confidentiality and integrity.
Отчет
Red Hat CloudForms 4.5 and 4.6 are now in Maintenance Support Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat CloudForms Life Cycle: https://access.redhat.com/support/policy/updates/cloudforms/
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | ansible | Out of support scope | ||
| Red Hat Ansible Tower 3 | ansible | Affected | ||
| Red Hat Ceph Storage 2 | ansible | Affected | ||
| Red Hat Ceph Storage 3 | ansible | Affected | ||
| Red Hat OpenShift Container Platform 3.2 | ansible | Will not fix | ||
| Red Hat OpenShift Container Platform 3.3 | ansible | Will not fix | ||
| Red Hat OpenShift Container Platform 3.4 | ansible | Will not fix | ||
| Red Hat OpenShift Container Platform 3.5 | ansible | Will not fix | ||
| Red Hat OpenShift Container Platform 3.6 | ansible | Will not fix | ||
| Red Hat OpenShift Container Platform 3.7 | ansible | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
4.2 Medium
CVSS3
Связанные уязвимости
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path ...
Уязвимость модуля fetch системы управления конфигурациями Ansible, связанная c неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к информации и нарушить ее целостность
EPSS
4.2 Medium
CVSS3