Vulnerability Description
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible Engine | < 2.7.17 |
| Redhat | Ansible Tower | <= 3.3.4 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737Issue TrackingVendor Advisory
- https://github.com/ansible/ansible/issues/67795Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202006-11
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737Issue TrackingVendor Advisory
- https://github.com/ansible/ansible/issues/67795Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202006-11
FAQ
What is CVE-2020-1737?
CVE-2020-1737 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong...
How severe is CVE-2020-1737?
CVE-2020-1737 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1737?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible Engine, Redhat Ansible Tower.