Cloudanix VulnDB

CVE-2023-5189

Medium · 6.5

CVSS

6.5

EPSS

1.0%

Published

Nov 14, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers can overwrite important files on systems running certain Red Hat automation tools by uploading a specially made archive file.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Path traversal during tarball extraction allows crafted symlinks to be written to disk, enabling arbitrary file overwrites when the galaxy importer processes the archive.

Why it matters to the business

Attackers can corrupt or replace critical configuration and code files in Ansible Automation Platform and Satellite deployments, leading to service disruption, data loss, or unauthorized system changes; the vulnerability has been public for nearly three years with publicly available exploits and a rising exploitation probability.

How an attack unfolds

An attacker crafts a tarball containing malicious symlinks, uploads it through the Ansible Automation Hub galaxy importer, and triggers extraction; the path traversal flaw follows the symlink and overwrites arbitrary files on the host filesystem. Public exploit code exists and the EPSS score has increased over the past month.

How to fix it

Upgrade Red Hat Ansible Automation Platform and Satellite to the latest patched releases that address CVE-2023-5189; until patches are applied, restrict or disable the galaxy importer feature and enforce strict input validation on uploaded archives.

How to confirm the fix worked

Review Ansible Automation Hub and importer logs for tarball extraction events, verify that no unexpected symlinks or overwritten files appear after archive processing, and confirm deployment of the corrected importer code.

Typical attack path

  1. Craft a tarball containing directory traversal symlinks targeting sensitive paths
  2. Upload the archive to Ansible Automation Hub via the galaxy importer
  3. Trigger or wait for extraction of the tarball
  4. Observe or leverage the resulting overwritten files for further access or denial of service

How to detect it

Search Ansible Automation Hub and galaxy importer logs for tarball extraction entries that reference symlinks or unusual path traversals; correlate with file system monitoring alerts for unexpected overwrites or symlink creation during import jobs.

What your security team should do

  • Prioritize patching Ansible Automation Platform and Satellite instances to the latest fixed versions
  • Temporarily disable or heavily restrict the galaxy importer until updates are deployed
  • Monitor EPSS trend and exploit availability for any increase in observed attempts
  • Add file integrity monitoring around directories commonly targeted by tarball extraction

The record

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Affected packages

Ecosystem Package Introduced Fixed
PyPI galaxy-importer 0 No fix
Red Hat:ansible_automation_platform:2.4::el8 ansible-core 0 1:2.15.8-1.el8ap
Red Hat:ansible_automation_platform:2.4::el8 python39-galaxy-importer 0 0:0.4.18-1.el8ap
Red Hat:ansible_automation_platform:2.4::el8 python3x-galaxy-importer 0 0:0.4.18-1.el8ap
Red Hat:ansible_automation_platform:2.4::el9 ansible-core 0 1:2.15.8-1.el9ap
Red Hat:ansible_automation_platform:2.4::el9 python-galaxy-importer 0 0:0.4.18-1.el9ap
Red Hat:ansible_automation_platform:2.4::el9 python3-galaxy-importer 0 0:0.4.18-1.el9ap
Red Hat:ansible_automation_platform_developer:2.4::el8 ansible-core 0 1:2.15.8-1.el8ap
Red Hat:ansible_automation_platform_developer:2.4::el9 ansible-core 0 1:2.15.8-1.el9ap
Red Hat:ansible_automation_platform_inside:2.4::el8 ansible-core 0 1:2.15.8-1.el8ap
Red Hat:ansible_automation_platform_inside:2.4::el9 ansible-core 0 1:2.15.8-1.el9ap
Red Hat:satellite:6.14::el8 python-aiohttp 0 0:3.9.2-0.1.el8pc
Red Hat:satellite:6.14::el8 python-aiohttp-debugsource 0 0:3.9.2-0.1.el8pc
Red Hat:satellite:6.14::el8 python-django 0 0:3.2.22-1.el8pc
Red Hat:satellite:6.14::el8 python-galaxy-importer 0 0:0.4.18-2.el8pc
Red Hat:satellite:6.14::el8 python-jinja2 0 0:3.1.3-0.1.el8pc
Red Hat:satellite:6.14::el8 python39-aiohttp 0 0:3.9.2-0.1.el8pc
Red Hat:satellite:6.14::el8 python39-aiohttp-debuginfo 0 0:3.9.2-0.1.el8pc
Red Hat:satellite:6.14::el8 python39-django 0 0:3.2.22-1.el8pc
Red Hat:satellite:6.14::el8 python39-galaxy-importer 0 0:0.4.18-2.el8pc
Red Hat:satellite:6.14::el8 python39-jinja2 0 0:3.1.3-0.1.el8pc
Red Hat:satellite:6.15::el8 foreman 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-cli 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-debug 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-dynflow-sidekiq 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-ec2 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-journald 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-libvirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-openstack 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-ovirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-pcp 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-postgresql 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-redis 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-service 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-telemetry 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 foreman-vmware 0 0:3.9.1.6-1.el8sat
Red Hat:satellite:6.15::el8 puppetserver 0 0:7.14.0-1.el8sat
Red Hat:satellite:6.15::el8 python-aiohttp 0 0:3.9.2-1.el8pc
Red Hat:satellite:6.15::el8 python-aiohttp-debugsource 0 0:3.9.2-1.el8pc
Red Hat:satellite:6.15::el8 python-django 0 0:4.2.9-1.el8pc
Red Hat:satellite:6.15::el8 python-galaxy-importer 0 0:0.4.19-2.el8pc
Red Hat:satellite:6.15::el8 python-jinja2 0 0:3.1.3-1.el8pc
Red Hat:satellite:6.15::el8 python-pycryptodomex 0 0:3.20.0-1.el8pc
Red Hat:satellite:6.15::el8 python-pycryptodomex-debugsource 0 0:3.20.0-1.el8pc
Red Hat:satellite:6.15::el8 python-pygments 0 0:2.17.0-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-aiohttp 0 0:3.9.2-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-aiohttp-debuginfo 0 0:3.9.2-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-django 0 0:4.2.9-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-galaxy-importer 0 0:0.4.19-2.el8pc
Red Hat:satellite:6.15::el8 python3.11-jinja2 0 0:3.1.3-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-pycryptodomex 0 0:3.20.0-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-pycryptodomex-debuginfo 0 0:3.20.0-1.el8pc
Red Hat:satellite:6.15::el8 python3.11-pygments 0 0:2.17.0-1.el8pc
Red Hat:satellite:6.15::el8 rubygem-activesupport 0 0:6.1.7.6-1.el8sat
Red Hat:satellite:6.15::el8 rubygem-audited 0 0:5.4.2-1.el8sat
Red Hat:satellite:6.15::el8 rubygem-puma 0 0:6.4.2-1.el8sat
Red Hat:satellite:6.15::el8 rubygem-puma-debuginfo 0 0:6.4.2-1.el8sat
Red Hat:satellite:6.15::el8 rubygem-puma-debugsource 0 0:6.4.2-1.el8sat
Red Hat:satellite_capsule:6.14::el8 python-aiohttp 0 0:3.9.2-0.1.el8pc
Red Hat:satellite_capsule:6.14::el8 python-aiohttp-debugsource 0 0:3.9.2-0.1.el8pc
Red Hat:satellite_capsule:6.14::el8 python-django 0 0:3.2.22-1.el8pc
Red Hat:satellite_capsule:6.14::el8 python-galaxy-importer 0 0:0.4.18-2.el8pc
Red Hat:satellite_capsule:6.14::el8 python-jinja2 0 0:3.1.3-0.1.el8pc
Red Hat:satellite_capsule:6.14::el8 python39-aiohttp 0 0:3.9.2-0.1.el8pc
Red Hat:satellite_capsule:6.14::el8 python39-aiohttp-debuginfo 0 0:3.9.2-0.1.el8pc
Red Hat:satellite_capsule:6.14::el8 python39-django 0 0:3.2.22-1.el8pc
Red Hat:satellite_capsule:6.14::el8 python39-galaxy-importer 0 0:0.4.18-2.el8pc
Red Hat:satellite_capsule:6.14::el8 python39-jinja2 0 0:3.1.3-0.1.el8pc
Red Hat:satellite_capsule:6.15::el8 foreman 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-cli 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-debug 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-dynflow-sidekiq 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-ec2 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-journald 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-libvirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-openstack 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-ovirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-pcp 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-postgresql 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-redis 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-service 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-telemetry 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 foreman-vmware 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_capsule:6.15::el8 puppetserver 0 0:7.14.0-1.el8sat
Red Hat:satellite_capsule:6.15::el8 python-aiohttp 0 0:3.9.2-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-aiohttp-debugsource 0 0:3.9.2-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-django 0 0:4.2.9-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-galaxy-importer 0 0:0.4.19-2.el8pc
Red Hat:satellite_capsule:6.15::el8 python-jinja2 0 0:3.1.3-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-pycryptodomex 0 0:3.20.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-pycryptodomex-debugsource 0 0:3.20.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python-pygments 0 0:2.17.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-aiohttp 0 0:3.9.2-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-aiohttp-debuginfo 0 0:3.9.2-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-django 0 0:4.2.9-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-galaxy-importer 0 0:0.4.19-2.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-jinja2 0 0:3.1.3-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-pycryptodomex 0 0:3.20.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-pycryptodomex-debuginfo 0 0:3.20.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 python3.11-pygments 0 0:2.17.0-1.el8pc
Red Hat:satellite_capsule:6.15::el8 rubygem-activesupport 0 0:6.1.7.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-cli 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-debug 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-dynflow-sidekiq 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-ec2 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-journald 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-libvirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-openstack 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-ovirt 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-pcp 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-postgresql 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-redis 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-service 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-telemetry 0 0:3.9.1.6-1.el8sat
Red Hat:satellite_utils:6.15::el8 foreman-vmware 0 0:3.9.1.6-1.el8sat
Ubuntu:20.04:LTS ansible 0 No fix
Ubuntu:22.04:LTS ansible 0 No fix
Ubuntu:22.04:LTS ansible-core 0 No fix
Ubuntu:24.04:LTS ansible 0 No fix
Ubuntu:24.04:LTS ansible-core 0 No fix
Ubuntu:24.10 ansible 0 No fix
Ubuntu:24.10 ansible-core 0 No fix
Ubuntu:25.04 ansible 0 No fix
Ubuntu:25.04 ansible-core 0 No fix
Ubuntu:25.10 ansible 0 No fix
Ubuntu:25.10 ansible-core 0 No fix
Ubuntu:Pro:14.04:LTS ansible 0 No fix
Ubuntu:Pro:16.04:LTS ansible 0 No fix
Ubuntu:Pro:18.04:LTS ansible 0 No fix
Ubuntu:Pro:20.04:LTS ansible 0 No fix
Ubuntu:Pro:22.04:LTS ansible 0 No fix

Related vulnerabilities