Description
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 8
Default version status: affected
0:2.14.11-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 9
Default version status: affected
0:2.14.11-1.el9ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
Default version status: affected
0:2.15.5-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
Default version status: affected
0:2.15.5-1.el9ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 1.2
Default version status: affected