Self Service Automation Portal 2
Monthly
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galaxy collection install` against a crafted collection tarball, because the archive extractor validates member paths with lexical normalization (os.path.abspath) instead of resolving symlinks (os.path.realpath) and performs no containment check on symlink-typed directory members before creating them, letting chained symlink entries redirect a subsequent file member outside the destination directory. The flaw (CWE-59, CVSS 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a bypass of the fix for CVE-2020-10691 and requires the victim to actively install the malicious collection, so an attacker can write arbitrary files with the privileges of the ansible-galaxy user and potentially achieve code execution on the control node. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; affected deployments include ansible-core 2.x as shipped in Red Hat Ansible Automation Platform 2 and numerous other Red Hat products, and no patched version is identified in the supplied intelligence, which currently cites only the Red Hat CVE page and Bugzilla 2531646.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.