Read the docs
TI-2023-04777 Aliases CVE-2023-5189GHSA-55g2-vm3q-7w52

Hub: insecure galaxy-importer tarfile extraction

Priority LOW 31CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00982 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 8—0.4.18-1.el8apPatch availableCNA
Red HatRed Hat Ansible Automation Platform 2.4 for RHEL 9—0.4.18-1.el9apPatch availableCNA
Red HatRed Hat Satellite 6.14 for RHEL 8—0.4.18-2.el8pcPatch availableCNA
Red HatRed Hat Satellite 6.14 for RHEL 8—0.4.18-2.el8pcPatch availableCNA
Red HatRed Hat Satellite 6.15 for RHEL 8—0.4.19-2.el8pcPatch availableCNA
Red HatRed Hat Satellite 6.15 for RHEL 8—0.4.19-2.el8pcPatch availableCNA
—galaxy-importer (PyPI)up to 0.4.16—No fix listedGHSA-55g2-vm3q-7w52
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 VendorRed Hat Affected — Fixed in 0.4.18-1.el8ap Patch available CNA
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9 VendorRed Hat Affected — Fixed in 0.4.18-1.el9ap Patch available CNA
  • Red Hat Satellite 6.14 for RHEL 8 VendorRed Hat Affected — Fixed in 0.4.18-2.el8pc Patch available CNA
  • Red Hat Satellite 6.14 for RHEL 8 VendorRed Hat Affected — Fixed in 0.4.18-2.el8pc Patch available CNA
  • Red Hat Satellite 6.15 for RHEL 8 VendorRed Hat Affected — Fixed in 0.4.19-2.el8pc Patch available CNA
  • Red Hat Satellite 6.15 for RHEL 8 VendorRed Hat Affected — Fixed in 0.4.19-2.el8pc Patch available CNA
  • galaxy-importer (PyPI) Vendor— Affected up to 0.4.16 Fixed in — No fix listed GHSA-55g2-vm3q-7w52

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat

Remediation

Red Hat 3 advisories

  • RHSA-2024:2010 Released 2024-04-23 · Red Hat rating Important
    Satellite 6.15.0 release
    • Red Hat Satellite 6.15 for RHEL 8 foreman-3.9.1.6-1.el8sat, foreman-cli-3.9.1.6-1.el8sat, foreman-debug-3.9.1.6-1.el8sat +28
  • RHSA-2024:1536 Released 2024-03-27 · Red Hat rating Moderate
    Satellite 6.14.3 Async Security Update
    • Red Hat Satellite 6.14 for RHEL 8 python-aiohttp-3.9.2-0.1.el8pc, python-django-3.2.22-1.el8pc, python-galaxy-importer-0.4.18-2.el8pc +5
  • RHSA-2023:7773 Released 2023-12-13 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core-1:2.15.8-1.el8ap, python39-galaxy-importer-0.4.18-1.el8ap, python3x-galaxy-importer-0.4.18-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core-1:2.15.8-1.el9ap, python-galaxy-importer-0.4.18-1.el9ap, python3-galaxy-importer-0.4.18-1.el9ap

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2023:7773
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2023:7773
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2024:1536
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2024:2010
Not affected: 4 products
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Satellite 6.14 for RHEL 8
  • Red Hat Satellite 6.15 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5189
  2. 2026-10-03 Alias added: GHSA-55g2-vm3q-7w52

References

Exploit 1

Advisory 5

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2023-27712 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences