win_unzip path traversal with specially crafted archive #67795
Labels
affects_2.10
This issue/PR affects Ansible v2.10
bug
This issue/PR relates to a bug.
has_pr
This issue has an associated PR.
module
This issue/PR relates to a module.
security
Related to a vulnerability or CVE
support:community
This issue/PR relates to code supported by the Ansible community.
windows
Windows community
SUMMARY
CVE-2020-1737
A specially crafted zip archive could result in path traversal in the
win_unzipmodule.The
Extract-Zipfunction doesn't check if the extracted path belongs to the destination folder.A possible solution is to check destination path.
ISSUE TYPE
COMPONENT NAME
lib/ansible/modules/windows/win_unzip.ps1ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
STEPS TO REPRODUCE
EXPECTED RESULTS
ACTUAL RESULTS
The text was updated successfully, but these errors were encountered: