Vulnerability Details : CVE-2020-1737
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Vulnerability category: Directory traversal
Products affected by CVE-2020-1737
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-1737
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-1737
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
0.8
|
6.0
|
Red Hat, Inc. | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2020-1737
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2020-1737
-
https://security.gentoo.org/glsa/202006-11
Ansible: Multiple vulnerabilities (GLSA 202006-11) — Gentoo security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
[SECURITY] Fedora 30 Update: ansible-2.9.6-1.fc30 - package-announce - Fedora Mailing-Lists
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737
1802154 – (CVE-2020-1737) CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not check extracted pathIssue Tracking;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
[SECURITY] Fedora 32 Update: ansible-2.9.6-1.fc32 - package-announce - Fedora Mailing-Lists
-
https://github.com/ansible/ansible/issues/67795
win_unzip path traversal with specially crafted archive · Issue #67795 · ansible/ansible · GitHubThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
[SECURITY] Fedora 31 Update: ansible-2.9.6-1.fc31 - package-announce - Fedora Mailing-Lists
Jump to