NVD Vulnerability Detail

CVE-2020-1737

Summary	A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Publication Date	March 10, 2020, 1:15 a.m.
Registration Date	Jan. 26, 2021, 11:54 a.m.
Last Update	Nov. 21, 2024, 2:11 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737	Issue Tracking Vendor Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737	Issue Tracking Vendor Advisory
3	https://github.com/ansible/ansible/issues/67795	Third Party Advisory
4	https://github.com/ansible/ansible/issues/67795	Third Party Advisory
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
11	https://security.gentoo.org/glsa/202006-11
12	https://security.gentoo.org/glsa/202006-11

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Ansible におけるパストラバーサルの脆弱性

Title	Ansible におけるパストラバーサルの脆弱性
Summary	Ansible には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 27, 2020, midnight
Registration Date	March 19, 2020, 4:52 p.m.
Last Update	March 19, 2020, 4:52 p.m.

Affected System

レッドハット

Ansible Tower 2.7.17 およびそれ以前

Ansible Tower 2.8.9 およびそれ以前

Ansible Tower 2.9.6 およびそれ以前

Red Hat Ansible Engine 2.7.17 およびそれ以前

Red Hat Ansible Engine 2.8.9 およびそれ以前

Red Hat Ansible Engine 2.9.6 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-1737	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1737
National Vulnerability Database (NVD)
2	CVE-2020-1737	https://nvd.nist.gov/vuln/detail/CVE-2020-1737

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
GitHub
1	win_unzip path traversal with specially crafted archive #67795	https://github.com/ansible/ansible/issues/67795
Red Hat Bugzilla
2	Bug 1802154	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737

Change Log

No	Changed Details	Date of change
1	[2020年03月19日] 掲載	March 19, 2020, 4:52 p.m.