{"action":"Upgrade ansible to 2.7.17 or later.","affected":[{"fixed":"2.7.17","introduced":"0"},{"fixed":"2.8.9","introduced":"2.8.0"},{"fixed":"2.9.6","introduced":"2.9.0"}],"component":"ansible","cve_ids":["CVE-2020-1737"],"ecosystem":"PyPI","epss":0.00365,"exploited":false,"fixed_versions":["2.7.17","2.8.9","2.9.6"],"ghsa_id":"GHSA-893h-35v4-mxqx","id":"tcs_01M5KGAYNJWJKKJBD285CRTAXX","modified_at":"2023-11-08T04:02:41.028950Z","published_at":"2020-03-09T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-9","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737","https://github.com/ansible/ansible/issues/67795","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/","https://security.gentoo.org/glsa/202006-11","https://github.com/advisories/GHSA-893h-35v4-mxqx"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2020-9","url":"https://osv.dev/vulnerability/PYSEC-2020-9"},{"source":"nvd","source_id":"CVE-2020-1737","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1737"}],"summary":"A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong"}