Read the docs
TI-2019-02840 Aliases CVE-2019-3828GHSA-74vq-h4q8-x6jv

Path traversal in Red Hat Ansible

Priority LOW 20CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 6 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

Why it matters now

EPSS 0.00522 44th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.5.15, 2.6.14, 2.7.8Red Hat: 6 advisoriesRed Hat: 6 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsible2.5.15; 2.6.14; 2.7.8—No fix listedCNA
—ansible (PyPI)before 2.5.152.5.15Patch availableGHSA-74vq-h4q8-x6jv
—ansible (PyPI)2.6.0a1 to before 2.6.142.6.14Patch availableGHSA-74vq-h4q8-x6jv
—ansible (PyPI)2.7.0a1 to before 2.7.82.7.8Patch availableGHSA-74vq-h4q8-x6jv
  • Ansible VendorRed Hat Affected 2.5.15; 2.6.14; 2.7.8 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 2.5.15 Fixed in 2.5.15 Patch available GHSA-74vq-h4q8-x6jv
  • ansible (PyPI) Vendor— Affected 2.6.0a1 to before 2.6.14 Fixed in 2.6.14 Patch available GHSA-74vq-h4q8-x6jv
  • ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.8 Fixed in 2.7.8 Patch available GHSA-74vq-h4q8-x6jv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*2.5.0 to before 2.5.15; 2.6.0 to before 2.6.14; 2.7.0 to before 2.7.8VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.15; 2.6.0 to before 2.6.14; 2.7.0 to before 2.7.8 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-74vq-h4q8-x6jv ansible (PyPI) Fixed in 2.5.15 Advisory →
  • Fix · GHSA-74vq-h4q8-x6jv ansible (PyPI) Fixed in 2.6.14 Advisory →
  • Fix · GHSA-74vq-h4q8-x6jv ansible (PyPI) Fixed in 2.7.8 Advisory →

Red Hat 6 advisories

  • RHSA-2019:3789 Released 2019-11-07 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 13.0 ansible-2.6.19-1.el7ae
  • RHSA-2019:3744 Released 2019-11-06 · Red Hat rating Moderate
    ansible security update
    • Red Hat OpenStack Platform 14.0 ansible-2.6.19-1.el7ae
  • RHSA-2019:0433 Released 2019-02-28 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.14-1.el7ae
Show 3 more Red Hat advisories
  • RHSA-2019:0432 Released 2019-02-28 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible-2.5.15-1.el7ae, ansible-doc-2.5.15-1.el7ae
  • RHSA-2019:0431 Released 2019-02-28 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.8-1.el7ae
  • RHSA-2019:0430 Released 2019-02-28 · Red Hat rating Moderate
    ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.7.8-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Out of support scope
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix yet
Red Hat OpenShift Container Platform 3.2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.5AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2019:0430
Red Hat Ansible Engine 2.5 for RHEL 7 ServerFixed RHSA-2019:0432
Red Hat Ansible Engine 2.6 for RHEL 7 ServerFixed RHSA-2019:0433
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2019:0431
Red Hat OpenStack Platform 13.0Fixed RHSA-2019:3789
Red Hat OpenStack Platform 14.0Fixed RHSA-2019:3744
Not affected: 1 product
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3828
  2. 2026-10-03 Alias added: GHSA-74vq-h4q8-x6jv

References

Patch 2

Advisory 8

Other 7

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences