Skip to content
Fencer Vulns
medium 6.3

CVE-2023-5115 json

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

published 2023-12-18 2 y ago modified 2026-11-07 42 h ago also EUVD-2023-3236 , GHSA-jpvw-p8pr-9g2x , PYSEC-2026-1120

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

Patch / fix

  • pypi ansible 8.5.0
  • Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 8 0:2.14.11-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 9 0:2.14.11-1.el9ap
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:2.15.5-1.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:2.15.5-1.el9ap
  • ansible Debian 14, Debian 13, Debian 12 5.4.0-1
  • ansible-core Debian 12 2.14.16-0+deb12u1
  • ansible-core Debian 14, Debian 13 2.14.11-1

debian advisories DEBIAN-CVE-2023-5115

  • ansible-core ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 2.15.5-1.el8ap
  • ansible-core ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 2.15.5-1.el9ap
  • python-django ansible automation platform 2.4 3.2.22-1.el9ap
  • python3-django ansible automation platform 2.4 3.2.22-1.el9ap
  • python39-django ansible automation platform 2.4 3.2.22-1.el8ap
  • python3x-django ansible automation platform 2.4 3.2.22-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.4.6-1.el8ap
  • automation-controller-venv-tower ansible automation platform 2.4 4.4.6-1.el9ap

red hat advisories RHSA-2023:5758RHSA-2023:5701

  • ansible-core-2.21 openSUSE Tumbleweed 2.21.6-1.1
  • ansible-core-2.20 openSUSE Tumbleweed 2.20.6-1.1
  • ansible-core-2.19 openSUSE Tumbleweed 2.19.4-1.1
  • ansible-core-2.18 openSUSE Tumbleweed 2.18.10-2.1
  • ansible-core-2.17 openSUSE Tumbleweed 2.17.6-1.1
  • ansible-core openSUSE Tumbleweed 2.16.9-1.1

opensuse advisories openSUSE-SU-2026:12451-1openSUSE-SU-2026:10945-1openSUSE-SU-2025:15754-1openSUSE-SU-2025:15638-1openSUSE-SU-2024:14537-1openSUSE-SU-2024:14251-1

  • ansible CBL-Mariner 2.0 2.14.11-1
  • ansible Azure Linux 3.0 2.17.0-1

azure linux advisories AZL-32279AZL-34540

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5115 updated cvss 6.3

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

  • Red Hat Ansible Automation Platform 1.2 ansible
    affected: no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.3 for RHEL 8 ansible-core 2.14.11-1.el8ap Red Hat Ansible Automation Platform 2.3 for RHEL 9 ansible-core 2.14.11-1.el9ap
    fixed: vendor fix RHSA-2023:5701
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core 2.15.5-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core 2.15.5-1.el9ap
    fixed: vendor fix RHSA-2023:5758
  • Red Hat Ansible Automation Platform 2.3 for RHEL 8 ansible-test 2.14.11-1.el8ap, automation-controller 4.3.16-1.el8ap, automation-controller-ui 4.3.16-1.el8ap, automation-controller-cli 4.3.16-1.el8ap, automation-controller-server 4.3.16-1.el8ap, automation-controller-venv-tower 4.3.16-1.el8ap Red Hat Ansible Automation Platform 2.3 for RHEL 9 ansible-test 2.14.11-1.el9ap, automation-controller 4.3.16-1.el9ap, automation-controller-ui 4.3.16-1.el9ap, automation-controller-cli 4.3.16-1.el9ap, automation-controller-server 4.3.16-1.el9ap, automation-controller-venv-tower 4.3.16-1.el9ap Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-test 2.15.5-1.el8ap, python39-django 3.2.22-1.el8ap, python3x-django 3.2.22-1.el8ap, automation-controller 4.4.6-1.el8ap, automation-controller-ui 4.4.6-1.el8ap, automation-controller-cli 4.4.6-1.el8ap, +2 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-test 2.15.5-1.el9ap, python-django 3.2.22-1.el9ap, python3-django 3.2.22-1.el9ap, automation-controller 4.4.6-1.el9ap, automation-controller-ui 4.4.6-1.el9ap, automation-controller-cli 4.4.6-1.el9ap, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
GitHub 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
OSV 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi ansible
<8.5.0
8.5.0

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.3 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 1.2

Classification

Weakness
  • CWE-36 Absolute Path Traversal
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.