Alpine: multiple ansible packages: security update to 2.7.17-r0

high Tenable Cloud Security Plugin ID 403501

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-
Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the
destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the
file system, using a path traversal. This issue is fixed in 2.10. (CVE-2020-1737)

- Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows
copying and overwriting files outside of the specified destination in the local ansible controller host,
by not restricting an absolute path. (CVE-2019-3828)

- A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when
running a playbook with an unprivileged become user. When Ansible needs to run a module with become user,
the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p
<dir>"; this operation does not fail if the directory already exists and is owned by another user. An
attacker could take advantage to gain control of the become user as the target directory can be retrieved
by iterating '/proc/<pid>/cmdline'. (CVE-2020-1733)

- A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set
with the argument "password" of svn module, it is used on svn command line, disclosing to other users
within the same node. An attacker could take advantage by reading the cmdline file from that particular
PID on the procfs. (CVE-2020-1739)

Plugin Details

Severity: High

ID: 403501

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-1737

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/12/2019

Reference Information

CVE: CVE-2019-3828, CVE-2020-1733, CVE-2020-1737, CVE-2020-1739, CVE-2020-1740, CVE-2020-1746

BID: 107650

IAVB: 2019-B-0092-S, 2022-B-0007

Detections

Analytics