FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ansible - win_unzip path normalization

Affected packages
ansible < 2.8.9
ansible27 < 2.7.17
ansible26 < 2.7.17
ansible25 < 2.7.17
ansible24 < 2.7.17
ansible23 < 2.7.17

Details

VuXML ID 0899c0d3-80f2-11ea-bafd-815569f3852d
Discovery 2020-02-12
Entry 2020-04-17

Borja Tarraso reports:

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

References

CVE Name CVE-2020-1737
URL https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737
URL https://github.com/ansible/ansible/issues/67795
URL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
URL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
URL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/