Executive brief
Ansible is an open-source automation tool used by system administrators to configure and manage infrastructure. When installing collections via ansible-galaxy, a flaw in the .tar.gz extraction process could allow a malicious collection archive to write files outside the intended directory, potentially overwriting critical system or application files. An attacker who can create or distribute a specially crafted collection could gain the ability to modify or corrupt files on systems running ansible-galaxy.
Technical details
A path traversal vulnerability exists in ansible-galaxy collection install due to insufficient sanitization of filenames when extracting .tar.gz archives (CWE-22). The vulnerable component is the tarfile extraction logic in Ansible 2.9.0 through 2.9.6. When a specially crafted collection archive with path traversal sequences (e.g., "../../../") in filenames is extracted, the files are written to unintended locations outside the collection directory. An attacker must provide or control the collection archive being installed, but no authentication or network access controls beyond initial download are required. The vulnerability was patched in Ansible 2.9.7 by adding filename validation before extraction to reject paths containing traversal sequences.
Affected products
- Ansible Ansible 2.9.0 through 2.9.6
Timeline
- 2020-04-30: disclosed: CVE-2020-10691 published to NVD
- 2020-03-31: patched: Fix merged in PR #68596
- 2021-04-20: advisory: GHSA-3c67-gc48-983w published