PyPI/ansible CVE-2020-1737: high 7.8, EPSS 0.36%
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong
Action: Upgrade ansible to 2.7.17 or later.
pip install ansible==2.7.17pip install ansible==2.8.9pip install ansible==2.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.17 | - |
| 2.8.0 | 2.8.9 | - |
| 2.9.0 | 2.9.6 | - |
Fixed versions
| 2.7.17 | 2.8.9 | 2.9.6 |
Sources
- osv: PYSEC-2020-9
- nvd: CVE-2020-1737
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737
- https://github.com/ansible/ansible/issues/67795
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
- https://security.gentoo.org/glsa/202006-11
- https://github.com/advisories/GHSA-893h-35v4-mxqx
CVE-2020-1737 · published · modified · JSON