Vulnerability · Published Dec 18, 2023 · Assigned by redhat
CVE-2023-5115Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
Medium 6.3
In plain English
A medium-severity security flaw in Red Hat Ansible Automation Platform 1.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.0%top 36.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5115 |
| Debian:13 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5115 |
| Debian:14 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5115 |
| Debian:12 | ansible-core | 2.14.16-0+deb12u1 | DEBIAN-CVE-2023-5115 |
| Debian:13 | ansible-core | 2.14.11-1 | DEBIAN-CVE-2023-5115 |
| Debian:14 | ansible-core | 2.14.11-1 | DEBIAN-CVE-2023-5115 |
| PyPI | ansible | 8.5.0 | GHSA-jpvw-p8pr-9g2x |
| PyPI | ansible | 8.5.0 | PYSEC-2026-1120 |
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:22.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:24.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:25.10 | ansible-core | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:26.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5115 |
| Ubuntu:26.10 | ansible-core | no fix listed | UBUNTU-CVE-2023-5115 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.3 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.3 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 1.2 | see references |
Weakness: CWE-36 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
References
- RHSA-2023:5701 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:5758 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-5115 vdb-entry, x_refsource_REDHAT
- RHBZ#2233810 issue-tracking, x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html x_transferred