{"action":"Upgrade ansible to 2.7.16 or later.","affected":[{"fixed":"2.7.16","introduced":"2.7.0a1"},{"fixed":"2.8.8","introduced":"2.8.0a1"},{"fixed":"2.9.3","introduced":"2.9.0a1"}],"component":"ansible","cve_ids":["CVE-2019-14905"],"ecosystem":"PyPI","epss":0.00713,"exploited":false,"fixed_versions":["2.7.16","2.8.8","2.9.3"],"ghsa_id":"GHSA-frxj-5j27-f8rf","id":"tcs_01M5KFG3G4DR4YBEDS3RNZA56R","modified_at":"2024-11-25T05:25:15.851785Z","published_at":"2021-04-20T16:44:49Z","references":["https://osv.dev/vulnerability/GHSA-frxj-5j27-f8rf","https://nvd.nist.gov/vuln/detail/CVE-2019-14905","https://access.redhat.com/errata/RHSA-2020:0216","https://access.redhat.com/errata/RHSA-2020:0218","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905","https://github.com/advisories/GHSA-frxj-5j27-f8rf","https://github.com/ansible/ansible","https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-206.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR","http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-frxj-5j27-f8rf","url":"https://osv.dev/vulnerability/GHSA-frxj-5j27-f8rf"}],"summary":"Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible"}