{"id":"CVE-2019-3828","published":"2019-03-27T00:00:00Z","modified":"2024-08-04T19:19:18Z","title":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and…","vendor":"Red Hat","product":"Ansible","tier":"tail","description":{"text":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.2,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00526,"percentile":0.445,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/ansible/ansible/pull/52133","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828","tags":[]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html","tags":["vendor-advisory"]},{"url":"https://usn.ubuntu.com/4072-1/","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3744","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3789","tags":["vendor-advisory"]},{"url":"http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html","tags":[]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":8.9},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":2.94}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"Ansible","versions":["2.5.15","2.6.14","2.7.8"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":["<2.5.15",">=2.6.0a1, <2.6.14",">=2.7.0a1, <2.7.8",">=2.5.0, <2.5.15",">=2.6.0, <2.6.14",">=2.7.0, <2.7.8"],"patched":["2.5.15","2.6.14","2.7.8"],"from":["GHSA-74vq-h4q8-x6jv","PYSEC-2019-5"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0009","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html"],"lineage":{"familyId":"fam-red-hat-ansible-cve-2016-8628","parents":[{"from":"CVE-2016-8628","to":"CVE-2019-3828","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/plugins/action/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf09","https://github.com/ansible/ansible/commit/396a2f74717477d80600450e2b7e45349d7b5110","https://github.com/ansible/ansible/commit/4be3215d2f9f84ca283895879f0c6ce1ed7dd333"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2019-3828","to":"CVE-2020-1733","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/plugins/action/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/396a2f74717477d80600450e2b7e45349d7b5110","https://github.com/ansible/ansible/commit/4be3215d2f9f84ca283895879f0c6ce1ed7dd333","https://github.com/ansible/ansible/commit/80b9a0a25c5f75e84aefc8f2b293fb1933b154f2","https://github.com/ansible/ansible/commit/8251d9f4c2bc82632ab992277fcd30ccbf87aa47"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-10875","published":"2018-07-13","fixed":"2.6.1","kev":false},{"cve":"CVE-2018-16837","published":"2018-10-23","fixed":"2.7.1","kev":false},{"cve":"CVE-2018-16876","published":"2019-01-03","fixed":"2.7.5","kev":false,"link":{"from":"CVE-2018-16876","to":"CVE-2019-3828","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.5.14","toFixed":"2.5.15","daysApart":83}]}},{"cve":"CVE-2019-3828","published":"2019-03-27","fixed":"2.7.8","kev":false},{"cve":"CVE-2018-16859","published":"2018-11-29","fixed":"2.8.1","kev":false},{"cve":"CVE-2019-10156","published":"2019-07-30","fixed":"2.8.2","kev":false,"link":{"from":"CVE-2019-3828","to":"CVE-2019-10156","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.6.14","toFixed":"2.6.18","daysApart":125}]}},{"cve":"CVE-2019-10206","published":"2019-11-22","fixed":"2.8.4","kev":false}],"package":"PyPI:ansible"}}