CVE-2020-10691 Path Traversal in Ansible

What is CVE-2020-10691?

CVE-2020-10691 is a medium-severity path traversal vulnerability in Redhat Ansible Tower, published on 30 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Weakness: CWE-22

Which versions are affected by CVE-2020-10691?

3 open source packages ship an affected version, including ansible. It affects 2 products.

Products include Redhat Ansible Engine, Redhat Ansible Tower.

How do I fix CVE-2020-10691?

Upgrade ansible to 2.9.7 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-10691 being exploited?

There is no known exploitation of CVE-2020-10691 in the wild and no public exploit code.

Other vulnerabilities in Redhat Ansible Tower

• CVE-2018-10874 Ansible Improper Input Validation vulnerability High 7.8
• CVE-2020-1737 Path Traversal in Ansible High 7.5
• CVE-2020-1734 OS Command Injection in ansible High 7.4
• CVE-2019-14858 Ansible leaks sensitive information to logs when told not to High 7.3
• CVE-2018-16859 Ansible Logs Passwords If PowerShell ScriptBlock is Enabled Medium 4.2

All Redhat Ansible Tower vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2020-10691, DEBIAN-CVE-2020-10691, GHSA-3c67-gc48-983w, PYSEC-2020-2, UBUNTU-CVE-2020-10691.