Media

Path Traversal in Ansible

Publicada: 30.04.2020
Actualizado: 11.10.2026 11:19

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	ansible	>= 2.9.0a1, < 2.9.7	2.9.7

Referencias

Puntuación CVSS 5.2/10

Vector CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Debilidad (CWE): CWE-22
Plataforma: Python (PyPI)
Paquete: ansible
Publicada: 30.04.2020
Actualizado: 11.10.2026 11:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2020-2 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-3c67-gc48-983w - CC BY 4.0

Historial de vulnerabilidades: ansible

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (68) en el archivo

Entradas en total: 68
Primera → última: 09.2013 12.2025
Sin corrección: 2
Explotada en ataques: 0

Distribución por gravedad

Crítica 9
Alta 24
Media 27
Baja 6
Sin evaluar 2

Divulgaciones por año

2017: 3
2018: 12
2019: 8
2020: 29
2021: 7
2022: 3
2023: 1
2024: 0
2025: 1
2026: 0

antes: 4

28.10.2022

Ansible leaks password to logs

Alta · 7.5 CVE-2022-3697 >= 2.5.0, < 7.0.0 7.0.0
22.09.2021

Improper Input Validation and Command Injection in Ansible

Alta · 7.1 CVE-2021-3583 < 2.9.23rc1, >= 2.10.0a1, < 2.10.11rc1, >= 2.11.0a1, < 2.11.2rc1 2.9.23rc1, 2.10.11rc1, 2.11.2rc1
26.05.2021

Insertion of Sensitive Information into Log File in ansible

Alta · 5.5 CVE-2021-20178 < 2.9.18 2.9.18
29.04.2021

Ansible Exposes Sensitive Information

Alta · 7.5 CVE-2021-20228 >= 2.10.0a1, < 2.10.6rc1, >= 2.9.0a1, < 2.9.18rc1, < 2.8.19rc1 2.10.6rc1, 2.9.18rc1, 2.8.19rc1
26.08.2020

OS Command Injection and Improper Input Validation in ansible

Alta · 7.3 CVE-2019-14904 < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
30.04.2020

Path Traversal in Ansible esta entrada

Media · 5.2 CVE-2020-10691 >= 2.9.0a1, < 2.9.7 2.9.7
31.03.2020

Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible

Alta · 5.6 CVE-2019-14905 >= 2.7.0a1, < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
09.03.2020

Path Traversal in Ansible

Alta · 7.8 CVE-2020-1737 >= 2.8.0a1, < 2.8.9, >= 2.9.0a1, < 2.9.6, < 2.7.17 2.8.9, 2.9.6, 2.7.17
03.03.2020

OS Command Injection in ansible

Alta · 7.4 CVE-2020-1734 >= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13 2.10.0rc1, 2.9.11, 2.8.13
20.02.2020

The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Crítica · 9.8 CVE-2014-4657 < 1.5.4 1.5.4
20.02.2020

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability ex

Crítica · 9.8 CVE-2014-4678 < 1.6.4 1.6.4
18.02.2020

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as de

Crítica · 9.8 CVE-2014-4967 < 1.6.7 1.6.7
18.02.2020

Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v

Crítica · 9.8 CVE-2014-4966 < 1.6.7 1.6.7
09.01.2020

Ansible prior to 1.5.4 mishandles the evaluation of some strings.

Alta · 7.5 CVE-2014-2686 < 1.5.4 1.5.4
26.11.2019

ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

Alta · 6.5 CVE-2019-14856 >= 2.6.0, < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
25.11.2019

Exposure of Sensitive Information to an Unauthorized Actor in ansible

Alta · 6.5 CVE-2019-10217 >= 2.8.0a1, < 2.8.4 2.8.4
22.11.2019

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain

Alta · 6.5 CVE-2019-10206 >= 2.6.0, < 2.6.19, >= 2.7.0, < 2.7.13, >= 2.8.0, < 2.8.4 2.6.19, 2.7.13, 2.8.4
08.10.2019

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin

Alta · 7.8 CVE-2019-14846 < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
03.01.2019

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Alta · 5.3 CVE-2018-16876 >= 2.5.0, < 2.5.14, >= 2.6.0, < 2.6.11, >= 2.7.0, < 2.7.5 2.5.14, 2.6.11, 2.7.5
23.10.2018

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen

Alta · 7.8 CVE-2018-16837 >= 2.7, < 2.7.1, >= 2.6, < 2.6.7, < 2.5.11 2.7.1, 2.6.7, 2.5.11

Mostrar más (14) Mostrando 20 de 34

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación