2023-12-18 17:00:28 +00:00
{
"id" : "CVE-2023-5115" ,
"sourceIdentifier" : "secalert@redhat.com" ,
"published" : "2023-12-18T14:15:10.500" ,
2023-12-29 19:00:29 +00:00
"lastModified" : "2023-12-29T17:57:50.077" ,
"vulnStatus" : "Analyzed" ,
2023-12-18 17:00:28 +00:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path."
2023-12-28 21:00:29 +00:00
} ,
{
"lang" : "es" ,
"value" : "Existe un ataque de path traversal absoluto en la plataforma de automatizaci\u00f3n Ansible. Esta falla permite a un atacante crear un rol de Ansible malicioso y hacer que la v\u00edctima ejecute el rol. Se puede utilizar un enlace simb\u00f3lico para sobrescribir un archivo fuera de la ruta de extracci\u00f3n."
2023-12-18 17:00:28 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
2023-12-29 19:00:29 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.3 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.1 ,
"impactScore" : 4.2
} ,
2023-12-18 17:00:28 +00:00
{
"source" : "secalert@redhat.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "LOW" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.3 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.1 ,
"impactScore" : 4.2
}
]
} ,
2023-12-29 19:00:29 +00:00
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-22"
}
]
}
] ,
"configurations" : [
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CBA4F8F3-6FC3-4ADD-BB96-A707E94AB0AB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_automation_platform:2.3:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "B520E9D8-A080-4927-B279-F1C57D993795"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "05986E3C-7E5B-45C1-81B0-9D856A8FF1CC"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F4CFF558-3C47-480D-A2F0-BABF26042943"
} ,
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_inside:1.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "4488C799-B9F7-40BC-B302-ED34149DBE15"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "897AB7AC-52B1-4335-97D5-D5EA2FF09CC6"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F4CFF558-3C47-480D-A2F0-BABF26042943"
} ,
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
]
}
]
} ,
{
"operator" : "AND" ,
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_developer:1.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "0D7F51B9-6E83-46BC-9E4B-7DD6C748435E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "CEE40363-D286-4EB7-80D2-17CF3B606AD6"
}
]
} ,
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "F4CFF558-3C47-480D-A2F0-BABF26042943"
} ,
{
"vulnerable" : false ,
"criteria" : "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*" ,
"matchCriteriaId" : "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
}
]
}
]
}
] ,
2023-12-18 17:00:28 +00:00
"references" : [
{
"url" : "https://access.redhat.com/errata/RHSA-2023:5701" ,
2023-12-29 19:00:29 +00:00
"source" : "secalert@redhat.com" ,
"tags" : [
"Vendor Advisory"
]
2023-12-18 17:00:28 +00:00
} ,
{
"url" : "https://access.redhat.com/errata/RHSA-2023:5758" ,
2023-12-29 19:00:29 +00:00
"source" : "secalert@redhat.com" ,
"tags" : [
"Vendor Advisory"
]
2023-12-18 17:00:28 +00:00
} ,
{
"url" : "https://access.redhat.com/security/cve/CVE-2023-5115" ,
2023-12-29 19:00:29 +00:00
"source" : "secalert@redhat.com" ,
"tags" : [
"Vendor Advisory"
]
2023-12-18 17:00:28 +00:00
} ,
{
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2233810" ,
2023-12-29 19:00:29 +00:00
"source" : "secalert@redhat.com" ,
"tags" : [
"Issue Tracking"
]
2023-12-28 21:00:29 +00:00
} ,
{
"url" : "https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html" ,
2023-12-29 19:00:29 +00:00
"source" : "secalert@redhat.com" ,
"tags" : [
"Mailing List" ,
"Third Party Advisory"
]
2023-12-18 17:00:28 +00:00
}
]
}
