GHSA-32p4-gm2c-wmch
Suggest an improvement- Source
- https://github.com/advisories/GHSA-32p4-gm2c-wmch
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-32p4-gm2c-wmch
- Aliases
- Published
- 2024-11-06T12:31:32Z
- Modified
- 2024-11-06T21:50:48.765882Z
- Severity
-
- 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- ansible-core Incorrect Authorization vulnerability
- Details
-
A flaw was found in Ansible. The ansible-core
usermodule can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes theusermodule against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2024-9902
- https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be
- https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65
- https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892
- https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd
- https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92
- https://access.redhat.com/errata/RHSA-2024:8969
- https://access.redhat.com/security/cve/CVE-2024-9902
- https://bugzilla.redhat.com/show_bug.cgi?id=2318271
- https://github.com/ansible/ansible
Affected packages
PyPI / ansible-core
Package
- Name
- ansible-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible-core
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.14.18rc1
Affected versions
0.*
0.0.1a1
2.*
2.11.0b1
2.11.0b2
2.11.0b3
2.11.0b4
2.11.0rc1
2.11.0rc2
2.11.0
2.11.1rc1
2.11.1
2.11.2rc1
2.11.2
2.11.3rc1
2.11.3
2.11.4rc1
2.11.4
2.11.5rc1
2.11.5
2.11.6rc1
2.11.6
2.11.7rc1
2.11.7
2.11.8rc1
2.11.8
2.11.9rc1
2.11.9
2.11.10rc1
2.11.10
2.11.11rc1
2.11.11
2.11.12rc1
2.11.12
2.12.0b1
2.12.0b2
2.12.0rc1
2.12.0
2.12.1rc1
2.12.1
2.12.2rc1
2.12.2
2.12.3rc1
2.12.3
2.12.4rc1
2.12.4
2.12.5rc1
2.12.5
2.12.6rc1
2.12.6
2.12.7rc1
2.12.7
2.12.8rc1
2.12.8
2.12.9rc1
2.12.9
2.12.10rc1
2.12.10
2.13.0b0
2.13.0b1
2.13.0rc1
2.13.0
2.13.1rc1
2.13.1
2.13.2rc1
2.13.2
2.13.3rc1
2.13.3
2.13.4rc1
2.13.4
2.13.5rc1
2.13.5
2.13.6rc1
2.13.6
2.13.7rc1
2.13.7
2.13.8rc1
2.13.8
2.13.9rc1
2.13.9
2.13.10rc1
2.13.10
2.13.11rc1
2.13.11
2.13.12rc1
2.13.12
2.13.13rc1
2.13.13
2.14.0b1
2.14.0b2
2.14.0b3
2.14.0rc1
2.14.0rc1.post0
2.14.0rc2
2.14.0
2.14.1rc1
2.14.1
2.14.2rc1
2.14.2
2.14.3rc1
2.14.3
2.14.4rc1
2.14.4
2.14.5rc1
2.14.5
2.14.6rc1
2.14.6
2.14.7rc1
2.14.7
2.14.8rc1
2.14.8
2.14.9rc1
2.14.9
2.14.10rc1
2.14.10
2.14.11rc1
2.14.11
2.14.12rc1
2.14.12
2.14.13
2.14.14rc1
2.14.14
2.14.15rc1
2.14.15
2.14.16rc1
2.14.16
2.14.17rc1
2.14.17
PyPI / ansible-core
Package
- Name
- ansible-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible-core
PyPI / ansible-core
Package
- Name
- ansible-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible-core
PyPI / ansible-core
Package
- Name
- ansible-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible-core
PyPI / ansible-core
Package
- Name
- ansible-core
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible-core