CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2020-1737
High (7.8) in redhat. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ansible 2.7.17, 2.8.9, 2.9.6.
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:ansible_engine
- redhat:ansible_tower
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-893h-35v4-mxqx | PyPI | ansible | >=2.8.0a1 <2.8.9 | 2.8.9 |
| GHSA-893h-35v4-mxqx | PyPI | ansible | >=2.9.0a1 <2.9.6 | 2.9.6 |
| GHSA-893h-35v4-mxqx | PyPI | ansible | <2.7.17 | 2.7.17 |
| PYSEC-2020-9 | PyPI | ansible | <2.7.17 >=2.8.0 <2.8.9 >=2.9.0 <2.9.6 | 2.7.17, 2.8.9, 2.9.6 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737
- https://github.com/ansible/ansible/issues/67795
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/