CVE-2023-5115
Fixed in a distro release EPSS 1%CVSS 6.3
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
Products: Red Hat Ansible Automation Platform 2.3 for RHEL 8, Red Hat Ansible Automation Platform 2.3 for RHEL 9, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 1.2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 8.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | ansible-core | 2.15.3-1.amzn2023.0.3 |
| Amazon Linux 2023 | ansible-test | 2.15.3-1.amzn2023.0.3 |
| Debian 10 | ansible | 2.7.7+dfsg-1+deb10u2 |
| Debian 12 | ansible | 5.4.0-1 |
| Debian 12 | ansible-core | 2.14.16-0+deb12u1 |
| Debian 13 | ansible | 5.4.0-1 |
| Debian 13 | ansible-core | 2.14.11-1 |
| Debian 14 | ansible | 5.4.0-1 |
| Debian 14 | ansible-core | 2.14.11-1 |
| Red Hat ansible automation platform 2.3 | ansible-core | 0:2.14.11-1.el9ap |
| Red Hat ansible automation platform 2.3 | ansible-core | 0:2.14.11-1.el8ap |
| Red Hat ansible automation platform 2.3 | automation-controller-venv-tower | 0:4.3.16-1.el9ap |
| Red Hat ansible automation platform 2.3 | automation-controller-venv-tower | 0:4.3.16-1.el8ap |
| Red Hat ansible automation platform 2.4 | ansible-core | 0:2.15.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | ansible-core | 0:2.15.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.4.6-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.4.6-1.el8ap |
| Red Hat ansible automation platform 2.4 | python-django | 0:3.2.22-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-django | 0:3.2.22-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-django | 0:3.2.22-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-django | 0:3.2.22-1.el8ap |
| Red Hat ansible automation platform developer 2.3 | ansible-core | 0:2.14.11-1.el9ap |
| Red Hat ansible automation platform developer 2.3 | ansible-core | 0:2.14.11-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | ansible-core | 0:2.15.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | ansible-core | 0:2.15.5-1.el9ap |
| Red Hat ansible automation platform inside 2.3 | ansible-core | 0:2.14.11-1.el9ap |
| Red Hat ansible automation platform inside 2.3 | ansible-core | 0:2.14.11-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | ansible-core | 0:2.15.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | ansible-core | 0:2.15.5-1.el9ap |
| Ubuntu 22.04 LTS | ansible-core | no fix |
| Ubuntu 24.04 LTS | ansible | no fix |
| Ubuntu 24.04 LTS | ansible-core | no fix |
| Ubuntu 25.10 | ansible | no fix |
| Ubuntu 25.10 | ansible-core | no fix |
| Ubuntu 26.04 LTS | ansible | no fix |
| Ubuntu 26.04 LTS | ansible-core | no fix |
| Ubuntu 26.10 | ansible | no fix |
| Ubuntu 26.10 | ansible-core | no fix |
| Ubuntu Pro 14.04 LTS | ansible | no fix |
| Ubuntu Pro 16.04 LTS | ansible | no fix |
| Ubuntu Pro 18.04 LTS | ansible | no fix |
| Ubuntu Pro 20.04 LTS | ansible | no fix |
| Ubuntu Pro 22.04 LTS | ansible | no fix |
| openSUSE Tumbleweed | ansible-core | 2.16.9-1.1 |
| openSUSE Tumbleweed | ansible-core-2.17 | 2.17.6-1.1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.10-2.1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.4-1.1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.6-1.1 |