CVE-2020-1737
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 9, 2020
- Updated
- Aug 4, 2024
- Reserved
- Nov 27, 2019
Description
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AnsibleRed Hat |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737
- https://github.com/ansible/ansible/issues/67795
- FEDORA-2020-a3f12bcff4vendor-advisory
- FEDORA-2020-0cab7041f7vendor-advisory
- FEDORA-2020-87f5e1e829vendor-advisory
- GLSA-202006-11vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.