A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00424.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Redhat
  • Ansible Automation Platform
  • Ansible Automation Platform Developer
  • Ansible Automation Platform Inside
  • Satellite
  • Satellite Capsule
  • Satellite Maintenance
  • Satellite Utils

Configuration 1 [-]

OR cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Ansible Automation Platform 2.4 for RHEL 8
python3x-galaxy-importer-0:0.4.18-1.el8ap cpe:/a:redhat:ansible_automation_platform:2.4::el8 RHSA-2023:7773 2023-12-13T00:00:00Z
Red Hat Ansible Automation Platform 2.4 for RHEL 9
python-galaxy-importer-0:0.4.18-1.el9ap cpe:/a:redhat:ansible_automation_platform:2.4::el9 RHSA-2023:7773 2023-12-13T00:00:00Z
Red Hat Satellite 6.14 for RHEL 8
python-galaxy-importer-0:0.4.18-2.el8pc cpe:/a:redhat:satellite:6.14::el8 RHSA-2024:1536 2024-03-27T00:00:00Z
python-galaxy-importer-0:0.4.18-2.el8pc cpe:/a:redhat:satellite_capsule:6.14::el8 RHSA-2024:1536 2024-03-27T00:00:00Z
Red Hat Satellite 6.15 for RHEL 8
python-galaxy-importer-0:0.4.19-2.el8pc cpe:/a:redhat:satellite:6.15::el8 RHSA-2024:2010 2024-04-23T00:00:00Z
python-galaxy-importer-0:0.4.19-2.el8pc cpe:/a:redhat:satellite_capsule:6.15::el8 RHSA-2024:2010 2024-04-23T00:00:00Z

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-2886 A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.
Github GHSA Github GHSA GHSA-55g2-vm3q-7w52 Ansible galaxy-importer Path Traversal vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2023:7773 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:1536 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2024:2010 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2023-5189 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2234387 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-5189 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-5189 cve-icon
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00475}

 epss

{'score': 0.00424}

Fri, 06 Dec 2024 11:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-23

Sat, 23 Nov 2024 04:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-10-09T23:36:44.631Z

Reserved: 2023-09-26T05:27:24.004Z

Link: CVE-2023-5189

cve-icon Vulnrichment

Updated: 2024-08-02T07:52:08.227Z

cve-icon NVD

Status : Modified

Published: 2023-11-14T23:15:12.290

Modified: 2024-12-06T11:15:07.380

Link: CVE-2023-5189

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-09-26T05:28:00Z

Links: CVE-2023-5189 - Bugzilla

cve-icon OpenCVE Enrichment

No data.