Vulnerability in Ansible Engine: Archive Traversal
Summary
CVE-2020-10691: An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. Affects ansible across 2 version ranges.
< 2.9.7-r0
>= 24325a05dfb9104d6d4ec8b488b89e07c2e6d376, < ff7bbbcaf1e8f434432075bc9c55626a9dd3091d
Fixed in 2.9.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible Engine is an open-source automation platform that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in various industries for its simplicity and flexibility. However, a vulnerability has been discovered in Ansible Engine that allows an attacker to overwrite system files during the extraction of a collection .tar.gz file. This vulnerability affects all ansible-engine versions 2.9.x prior to 2.9.7 when running ansible-galaxy collection install.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10691, is an archive traversal flaw. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. This allows an attacker to manipulate the filename and overwrite any file within the system. By exploiting this vulnerability, an attacker could potentially gain unauthorized access, modify critical files, or disrupt the normal functioning of the system.
How To Fix
Minimum fixed version
2.9.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the filenames before extracting the collection .tar.gz file. This can be done by inspecting the filenames and ensuring they do not contain any malicious or unexpected characters. However, it is strongly advised to apply the official fix by updating Ansible Engine to the latest version as soon as possible.
Conclusion
In conclusion, the vulnerability in Ansible Engine allows an attacker to overwrite system files during the extraction of a collection .tar.gz file. To mitigate this risk, it is crucial to update Ansible Engine to version 2.9.7 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation platform used for configuration management, application deployment, and orchestration.
This vulnerability allows an attacker to overwrite system files, potentially leading to unauthorized access, file modification, or disruption of system functionality.
All ansible-engine versions 2.9.x prior to 2.9.7 are affected by this vulnerability.
To fix this vulnerability, update Ansible Engine to version 2.9.7 or later by following the official documentation provided by the Ansible project.
As a temporary workaround, users can manually sanitize filenames before extracting the collection .tar.gz file. However, it is recommended to apply the official fix by updating Ansible Engine to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
