CVE-2020-10691

Advisory

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-3c67-gc48-983w
• https://nvd.nist.gov/vuln/detail/CVE-2020-10691
• https://github.com/ansible/ansible/pull/68596
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10691