CVE-2019-3828

low-risk

Published 2019-03-27

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.2/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Ansible

Affected Vendors

Redhat

References (18)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3744

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3789

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828

Patch https://github.com/ansible/ansible/pull/52133

Third Party Advisory https://usn.ubuntu.com/4072-1/