CVE-2020-10691: Path Traversal

April 30, 2020 (updated May 21, 2020)

An archive traversal flaw was found in all ansible-engine, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
nvd.nist.gov/vuln/detail/CVE-2020-10691

Code Behaviors & Features

Detect and mitigate CVE-2020-10691 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →