{"id":"CVE-2023-5115","state":"PUBLISHED","title":"Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files","description":"An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.","publishedAt":"2023-12-18T13:43:07.791Z","updatedAt":"2025-11-20T17:29:54.523Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 8","Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 9","Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8","Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9","Red Hat Red Hat Ansible Automation Platform 1.2"],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.3 for RHEL 8","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.14.11-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9","cpe:/a:redhat:ansible_automation_platform:2.3::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8","cpe:/a:redhat:ansible_automation_platform:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.3 for RHEL 9","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.14.11-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9","cpe:/a:redhat:ansible_automation_platform:2.3::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8","cpe:/a:redhat:ansible_automation_platform:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.15.5-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.15.5-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 1.2","packageName":"ansible","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform"]}],"references":["https://access.redhat.com/errata/RHSA-2023:5701","https://access.redhat.com/errata/RHSA-2023:5758","https://access.redhat.com/security/cve/CVE-2023-5115","https://bugzilla.redhat.com/show_bug.cgi?id=2233810","https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html"],"weaknesses":["CWE-36"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5115.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-5115","state":"PUBLISHED","datePublished":"2023-12-18T13:43:07.791Z","dateUpdated":"2025-11-20T17:29:54.523Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-09-21T19:29:27.130Z"},"containers":{"cna":{"title":"Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files","descriptions":[{"lang":"en","value":"An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.3 for RHEL 8","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.14.11-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9","cpe:/a:redhat:ansible_automation_platform:2.3::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8","cpe:/a:redhat:ansible_automation_platform:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.3 for RHEL 9","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.14.11-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform_developer:2.3::el9","cpe:/a:redhat:ansible_automation_platform:2.3::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.3::el8","cpe:/a:redhat:ansible_automation_platform:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.3::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.15.5-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","packageName":"ansible-core","defaultStatus":"affected","versions":[{"version":"0:2.15.5-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 1.2","packageName":"ansible","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5701","name":"RHSA-2023:5701","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5758","name":"RHSA-2023:5758","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5115","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233810","name":"RHBZ#2233810","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-36","description":"Absolute Path Traversal","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-20T17:29:54.523Z"},"datePublic":"2023-09-21T19:33:00.000Z","x_redhatCweChain":"CWE-36: Absolute Path Traversal","timeline":[{"lang":"en","time":"2023-08-23T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-09-21T19:33:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5701","name":"RHSA-2023:5701","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5758","name":"RHSA-2023:5758","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5115","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233810","name":"RHBZ#2233810","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:44:53.777Z"}}]}}}