CVE-2020-1737

Name of the Vulnerable Software and Affected Versions Ansible versions 2.7.17 and prior Ansible versions 2.8.9 and prior Ansible versions 2.9.6 and prior

Description A flaw was found in Ansible when using the Extract-Zip function from the win unzip module. The extracted file(s) are not checked if they belong to the destination folder, allowing an attacker to craft an archive anywhere in the file system using a path traversal. This issue may impact the confidentiality, integrity, and availability of protected information.

Recommendations For Ansible versions 2.7.17 and prior, update to version 2.10 or later. For Ansible versions 2.8.9 and prior, update to version 2.10 or later. For Ansible versions 2.9.6 and prior, update to version 2.10 or later. As a temporary workaround, consider restricting the use of the win unzip module until a patch is available.