Media

Ansible symlink attack vulnerability

Publicada: 28.12.2023
Actualizado: 11.10.2026 13:18

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	ansible	< 8.5.0	8.5.0

Referencias

Puntuación CVSS 6.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Debilidad (CWE): CWE-22, CWE-36
Plataforma: Python (PyPI)
Paquete: ansible
Publicada: 28.12.2023
Actualizado: 11.10.2026 13:18

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-1120 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-jpvw-p8pr-9g2x - CC BY 4.0

Historial de vulnerabilidades: ansible

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (68) en el archivo

Entradas en total: 68
Primera → última: 09.2013 12.2025
Sin corrección: 2
Explotada en ataques: 0

Distribución por gravedad

Crítica 9
Alta 24
Media 27
Baja 6
Sin evaluar 2

Divulgaciones por año

2017: 3
2018: 12
2019: 8
2020: 29
2021: 7
2022: 3
2023: 1
2024: 0
2025: 1
2026: 0

antes: 4

28.12.2023

Ansible symlink attack vulnerability esta entrada

Media · 6.3 CVE-2023-5115 < 8.5.0 8.5.0
28.10.2022

Ansible leaks password to logs

Alta · 7.5 CVE-2022-3697 >= 2.5.0, < 7.0.0 7.0.0
22.09.2021

Improper Input Validation and Command Injection in Ansible

Alta · 7.1 CVE-2021-3583 < 2.9.23rc1, >= 2.10.0a1, < 2.10.11rc1, >= 2.11.0a1, < 2.11.2rc1 2.9.23rc1, 2.10.11rc1, 2.11.2rc1
26.05.2021

Insertion of Sensitive Information into Log File in ansible

Alta · 5.5 CVE-2021-20178 < 2.9.18 2.9.18
29.04.2021

Ansible Exposes Sensitive Information

Alta · 7.5 CVE-2021-20228 >= 2.10.0a1, < 2.10.6rc1, >= 2.9.0a1, < 2.9.18rc1, < 2.8.19rc1 2.10.6rc1, 2.9.18rc1, 2.8.19rc1
26.08.2020

OS Command Injection and Improper Input Validation in ansible

Alta · 7.3 CVE-2019-14904 < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
31.03.2020

Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible

Alta · 5.6 CVE-2019-14905 >= 2.7.0a1, < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
09.03.2020

Path Traversal in Ansible

Alta · 7.8 CVE-2020-1737 >= 2.8.0a1, < 2.8.9, >= 2.9.0a1, < 2.9.6, < 2.7.17 2.8.9, 2.9.6, 2.7.17
03.03.2020

OS Command Injection in ansible

Alta · 7.4 CVE-2020-1734 >= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13 2.10.0rc1, 2.9.11, 2.8.13
20.02.2020

The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Crítica · 9.8 CVE-2014-4657 < 1.5.4 1.5.4
20.02.2020

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability ex

Crítica · 9.8 CVE-2014-4678 < 1.6.4 1.6.4
18.02.2020

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as de

Crítica · 9.8 CVE-2014-4967 < 1.6.7 1.6.7
18.02.2020

Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v

Crítica · 9.8 CVE-2014-4966 < 1.6.7 1.6.7
09.01.2020

Ansible prior to 1.5.4 mishandles the evaluation of some strings.

Alta · 7.5 CVE-2014-2686 < 1.5.4 1.5.4
26.11.2019

ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

Alta · 6.5 CVE-2019-14856 >= 2.6.0, < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
25.11.2019

Exposure of Sensitive Information to an Unauthorized Actor in ansible

Alta · 6.5 CVE-2019-10217 >= 2.8.0a1, < 2.8.4 2.8.4
22.11.2019

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain

Alta · 6.5 CVE-2019-10206 >= 2.6.0, < 2.6.19, >= 2.7.0, < 2.7.13, >= 2.8.0, < 2.8.4 2.6.19, 2.7.13, 2.8.4
08.10.2019

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin

Alta · 7.8 CVE-2019-14846 < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
03.01.2019

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Alta · 5.3 CVE-2018-16876 >= 2.5.0, < 2.5.14, >= 2.6.0, < 2.6.11, >= 2.7.0, < 2.7.5 2.5.14, 2.6.11, 2.7.5
23.10.2018

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen

Alta · 7.8 CVE-2018-16837 >= 2.7, < 2.7.1, >= 2.6, < 2.6.7, < 2.5.11 2.7.1, 2.6.7, 2.5.11

Mostrar más (14) Mostrando 20 de 34

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación