Ansible: Schwachstelle ermöglicht Manipulation von Dateien

Summary

Product

Vulnerabilities 1

• Medium 6.3
  CVE-2023-5115

  Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

  An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 1.2 Debian Ubuntu Azure Linux PyPI
  Dec 18, 2023

Revision history

1. 2026-06-07 #9

   Neue Updates von openSUSE aufgenommen

2. 2025-11-23 #8

   Neue Updates von openSUSE aufgenommen

3. 2024-12-03 #7

   Neue Updates von openSUSE aufgenommen

4. 2023-12-28 #6

   Neue Updates von Debian aufgenommen

5. 2023-10-16 #5

   Neue Updates von Red Hat aufgenommen

6. 2023-10-15 #4

   Neue Updates von Red Hat aufgenommen

7. 2023-10-12 #3

   Neue Updates von Fedora aufgenommen

8. 2023-10-03 #2

   Neue Updates von Fedora aufgenommen

9. 2023-09-26 #1

   Initiale Fassung

References

• Ansible Security Notification vom 2023-09-26
  https://bugzilla.redhat.com/show_bug.cgi?id=2233810
• Ansible Security Notification vom 2023-09-26
  https://access.redhat.com/security/cve/cve-2023-5115
• Ansible Security Notification vom 2023-09-26
  https://github.com/ansible/ansible/commit/ddf0311c63287e2d5334770377350c1e0cbfff28
• Fedora Security Advisory FEDORA-2023-389ED7A7E7 vom 2023-10-04
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-389ed7a7e7
• Fedora Security Advisory FEDORA-2023-CDC7DB366E vom 2023-10-12
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-cdc7db366e
• Fedora Security Advisory FEDORA-2023-E5D4A632A5 vom 2023-10-12
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-e5d4a632a5
• Red Hat Security Advisory RHSA-2023:5701 vom 2023-10-16
  https://access.redhat.com/errata/RHSA-2023:5701
• Red Hat Security Advisory RHSA-2023:5758 vom 2023-10-16
  https://access.redhat.com/errata/RHSA-2023:5758
• Debian Security Advisory DLA-3695 vom 2023-12-28
  https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
• openSUSE Security Update OPENSUSE-SU-2024:14537-1 vom 2024-12-03
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2Y6RFLPB54N7XR7AP7A2DEXGLBEDEQJU/
• openSUSE Security Update OPENSUSE-SU-2025:15754-1 vom 2025-11-22
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QBAHQDLLO4EUEQG4IUN2D6GLV7TJAWB5/
• openSUSE Security Update OPENSUSE-SU-2026:10945-1 vom 2026-06-07
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UE5263L2QI6D2LMNCCIQN6SBZIVCICYV/