CVE-2023-5115 Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.3 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.14.11-1.el8ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.3::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.3 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.14.11-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9",
      "cpe:/a:redhat:ansible_automation_platform:2.3::el9",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.15.5-1.el8ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 2.4 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.15.5-1.el9ap",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9",
      "cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8",
      "cpe:/a:redhat:ansible_automation_platform:2.4::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Ansible Automation Platform 1.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "ansible",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:ansible_automation_platform"
    ]
  }
]