CVE-2023-5115: falha de média gravidade em Red Hat Ansible Automation Platform 1.2
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 1.0%
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
Produtos afetados
Red Hat · Red Hat Ansible Automation Platform 1.2Red Hat · Red Hat Ansible Automation Platform 2.3 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.3 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9CVEs relacionadas — Red Hat Ansible Automation Platform 1.2
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2023-5764HIGHAnsible: template injectionEPSS 0.6%CVE-2022-3205MEDIUMController: cross site scripting in automation controller uiEPSS 0.5%CVE-2022-3248MEDIUMOpenshift api admission checks does not enforce "custom-host" permissionsEPSS 0.5%