Description
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
Default version status: affected
0:0.4.18-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
Default version status: affected
0:0.4.18-1.el9ap to < *unaffected
Red Hat Red Hat Satellite 6.14 for RHEL 8
Default version status: affected
0:0.4.18-2.el8pc to < *unaffected
Red Hat Red Hat Satellite 6.14 for RHEL 8
Default version status: affected
0:0.4.18-2.el8pc to < *unaffected
Red Hat Red Hat Satellite 6.15 for RHEL 8
Default version status: affected
0:0.4.19-2.el8pc to < *unaffected
Red Hat Red Hat Satellite 6.15 for RHEL 8
Default version status: affected
0:0.4.19-2.el8pc to < *unaffected