| Package | Affected versions | Patched versions |
|---|---|---|
| ansible | ≥ 2.9.0, < 2.9.7≥ 2.9.0a1, < 2.9.7 | 2.9.7 |
| ansible engine | ≥ 2.9.0, < 2.9.7 | 2.9.7 |
| ansible tower | = 3.0 |
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free