VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Nov 14, 2023· Updated Jun 17, 2026

CVE-2023-5189

CVE-2023-5189

Description

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
galaxy-importerPyPI
<= 0.4.16—

Affected products

6
  • Red Hat/Ansible Automation Platformcpe-rescue2 versions
    cpe:/a:redhat:ansible_automation_platform:2.4::el8+ 1 more
    • cpe:/a:redhat:ansible_automation_platform:2.4::el8range: 0:0.4.18-1.el9ap
    • cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
  • Red Hat/Red Hat Satellite 6.14 for RHEL 8v5
    cpe:/a:redhat:satellite:6.14::el8
    Range: 0:0.4.18-2.el8pc
  • Red Hat/Red Hat Satellite 6.15 for RHEL 8v5
    cpe:/a:redhat:satellite_utils:6.15::el8
    Range: 0:0.4.19-2.el8pc
  • Red Hat/Satellite
    cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/galaxy-importer
    Range: <= 0.4.16

Patches

Vulnerability mechanics

References

8

News mentions

0

No linked articles in our index yet.