34 matches found
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
CVE-2026-89091
A flaw exists in ansible-core where the archive extractor used in ansible-galaxy collection install validates member paths using lexical path normalization (os.path.abspath ) instead of resolving symbolic links (os.path.realpath ). Because the system performs no containment check on symlink-typed...
CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
Security update for ansible-core
This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:4154-1 Security update for ansible-core
This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...
Security update for ansible-core (important)
openSUSE security update: security update for ansible-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21828-1 Rating: important References: bsc1272369 Cross-References: CVE-2026-11332 CVE-2026-16493 CVSS scores: CVE-2026-11332 SUSE : 7.8...
OPENSUSE-SU-2026:21828-1 Security update for ansible-core
This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...
ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
Important: ansible-core
Issue Overview: A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provid...
SUSE CVE-2026-16493
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
CVE-2026-16493
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
AZL-93102 CVE-2026-16493 affecting package ansible 2.17.11-1
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
CVE-2026-16493
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
EUVD-2026-46336
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
CVE-2026-16493
The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...
CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...
Arbitrary Argument Injection
Overview ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load...