{"action":"Upgrade ansible to 1.2.3 or later.","affected":[{"fixed":"1.2.3","introduced":"0"}],"component":"ansible","cve_ids":["CVE-2013-4259"],"ecosystem":"PyPI","epss":0.00339,"exploited":false,"fixed_versions":["1.2.3"],"ghsa_id":"GHSA-fj24-ghp9-39v3","id":"tcs_01M5KG5PZJ8GX07XG6TFA7X1MG","modified_at":"2026-06-10T17:00:10.424907437Z","published_at":"2013-09-16T19:14:00Z","references":["https://osv.dev/vulnerability/PYSEC-2013-1","https://bugzilla.redhat.com/show_bug.cgi?id=998223","http://www.ansible.com/security","https://groups.google.com/forum/#!topic/ansible-project/UVDYW0HGcNg","https://github.com/advisories/GHSA-fj24-ghp9-39v3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2013-1","url":"https://osv.dev/vulnerability/PYSEC-2013-1"}],"summary":"runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/"}