CVE-2019-3828 Ansible Path Traversal vulnerability

Medium 4.2 Published 27 Mar 2019 Updated 4 Aug 2024

Attackers can overwrite or read files outside the intended destination on the Ansible controller host via the fetch module.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-3828?

CVE-2019-3828 is a medium-severity path traversal vulnerability in Red Hat Ansible, published on 27 Mar 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

Weakness: CWE-22

Which versions are affected by CVE-2019-3828?

7 open source packages ship an affected version, including ansible. It affects 1 product.

Package	Affected	Fixed in
`ansible` PyPI	All versions	`2.5.15`
`ansible` PyPI	All versions	`2.5.15`
`ansible` PyPI	From `2.5.0`	`2.5.15, 2.6.14, 2.7.8`
`ansible` PyPI	From `2.6.0a1`	`2.6.14`
`ansible` PyPI	From `2.6.0a1`	`2.6.14`
`ansible` PyPI	From `2.7.0a1`	`2.7.8`

1 more packages

ansible PyPI From 2.7.0a1 2.7.8

Linux distribution packages (5)

`ansible` Red Hat:ansible_engine:2.5::el7	All versions	`0:2.5.15-1.el7ae`
`ansible-doc` Red Hat:ansible_engine:2.5::el7	All versions	`0:2.5.15-1.el7ae`
`ansible` Red Hat:ansible_engine:2.6::el7	All versions	`0:2.6.14-1.el7ae`
`ansible` Red Hat:ansible_engine:2.7::el7	All versions	`0:2.7.8-1.el7ae`
`ansible` Red Hat:ansible_engine:2::el7	All versions	`0:2.7.8-1.el7ae`

Products include Redhat Ansible.

How do I fix CVE-2019-3828?

Upgrade ansible to a fixed version for your release line: 2.5.15, 2.6.14 or 2.7.8.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-3828 being exploited?

There is no known exploitation of CVE-2019-3828 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2019-3828, DEBIAN-CVE-2019-3828, GHSA-74vq-h4q8-x6jv, MGASA-2019-0114, OESA-2022-1565, PYSEC-2019-5 and 5 more.