Read the docs
TI-2020-08594 Aliases CVE-2020-10691GHSA-3c67-gc48-983w

Path traversal in Red Hat Ansible

Priority LOW 23CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Why it matters now

EPSS 0.00303 23rd percentileScored 2026-11-07
Fix Fixed ansible (PyPI): 2.9.7Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsibleall ansible-engine versions 2.9.x prior to 2.9.7—No fix listedCNA
—ansible (PyPI)2.9.0a1 to before 2.9.72.9.7Patch availableGHSA-3c67-gc48-983w
  • Ansible VendorRed Hat Affected all ansible-engine versions 2.9.x prior to 2.9.7 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.7 Fixed in 2.9.7 Patch available GHSA-3c67-gc48-983w

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*2.9.0 to before 2.9.7VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions 2.9.0 to before 2.9.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-3c67-gc48-983w ansible (PyPI) Fixed in 2.9.7 Advisory →

Red Hat 2 advisories

  • RHSA-2020:1542 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.9.7)
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae
  • RHSA-2020:1541 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.9.7)
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2020:1542
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2020:1542
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2020:1541
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2020:1541
Red Hat Ansible Tower 3.6 for RHEL 7Fixed—
Not affected: 5 products
  • Red Hat Ceph Storage 2
  • Red Hat Ceph Storage 3
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10691
  2. 2026-10-03 Alias added: GHSA-3c67-gc48-983w

References

Patch 1

Advisory 3

Other 3

  • TI-2018-05593 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before… CVSS 3.1CRITICAL 9.8
  • TI-2017-05127 Improper input validation in [UNKNOWN] ansible CVSS 3.1CRITICAL 9.8
  • TI-2021-03523 Information disclosure in ansible CVSS 3.1HIGH 7.5
  • TI-2019-11051 Sensitive information in log files in Red Hat Ansible CVSS 3.1HIGH 7.8
  • TI-2018-07689 Untrusted search path in [UNKNOWN] ansible CVSS 3.1HIGH 7.8
  • TI-2018-07688 Untrusted search path in [UNKNOWN] ansible CVSS 3.0HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences