CVE-2023-5115
Public on 2023-09-22
Modified on 2024-02-12
Description
The upstream report describes this issue as follows:
When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target file, followed by a file of the same name (as the symlink) with the contents to write to the target.
CVSS v3 Base Score
See breakdown
