GoogleOSV:GHSA-JPVW-P8PR-9G2XAnsible symlink attack vulnerability
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
0.001 Low
EPSS
Percentile
29.6%
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
References
access.redhat.com/errata/RHSA-2023:5701
access.redhat.com/errata/RHSA-2023:5758
access.redhat.com/security/cve/CVE-2023-5115
bugzilla.redhat.com/show_bug.cgi?id=2233810
github.com/ansible-community/ansible-build-data/blob/16d36538b96c65d9e0e28d89781361b69857ac0e/8/CHANGELOG-v8.rst#L221
github.com/ansible/ansible
github.com/ansible/ansible/commit/1e930684bc0a76ec3d094cd326738ad26416541c
lists.debian.org/debian-lts-announce/2023/12/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2023-5115
Related
6.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
0.001 Low
EPSS
Percentile
29.6%