Bug 2233810 (CVE-2023-5115) - CVE-2023-5115 Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files [NEEDINFO]
Summary: CVE-2023-5115 Ansible: malicious role archive can cause ansible-galaxy to ove...
Keywords:
Status: NEW
Alias: CVE-2023-5115
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2233812
TreeView+ depends on / blocked
 
Reported: 2023-08-23 14:20 UTC by Mauro Matteo Cascella
Modified: 2025-05-15 08:28 UTC (History)
32 users (show)

Fixed In Version: ansible 2.14.11
Clone Of:
Environment:
Last Closed:
Embargoed:
vinair: needinfo? (bugzilla_throwaway)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:5701 0 None None None 2023-10-16 01:02:19 UTC
Red Hat Product Errata RHSA-2023:5758 0 None None None 2023-10-16 15:36:07 UTC

Description Mauro Matteo Cascella 2023-08-23 14:20:25 UTC 
When installing a maliciously created Ansible role using `ansible-galaxy role install`, arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target file, followed by a file of the same name (as the symlink) with the contents to write to the target.
Comment 4 bugzilla_throwaway 2023-09-22 09:11:24 UTC 
Could you please provide the version number where this is fixed in ansible or a link to a fixing commit? Or is this still unfixed upstream?

Thanks a lot!
Comment 5 Mauro Matteo Cascella 2023-09-22 09:56:41 UTC 
This was reported internally, I'm not sure there are any upstream references. Tagging vinair to elaborate further.
Comment 6 Vipul Nair 2023-09-29 11:46:31 UTC 
heya,there you go https://github.com/ansible/ansible/pull/81780.
Comment 7 errata-xmlrpc 2023-10-16 01:02:17 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.3 for RHEL 8
  Red Hat Ansible Automation Platform 2.3 for RHEL 9

Via RHSA-2023:5701 https://access.redhat.com/errata/RHSA-2023:5701
Comment 8 errata-xmlrpc 2023-10-16 15:36:06 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2023:5758 https://access.redhat.com/errata/RHSA-2023:5758
Note You need to log in before you can comment on or make changes to this bug.