CVE catalog
CVE-2020-1737
ansible: CVE-2020-1737
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.36% · Oct 25, 2026
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ansible | sid | 14.4.0+dfsg-1 | fixed |
| Debian | ansible | forky | 14.0.0+dfsg-1 | fixed |
| Debian | ansible | trixie | 12.0.0+dfsg-0+deb13u1 | fixed |
| Debian | ansible | bookworm | 7.7.0+dfsg-3+deb12u1 | fixed |
| Alpine | ansible | 3.10 | 2.8.9-r0 | fixed |
| Alpine | ansible | 3.11 | 2.9.6-r0 | fixed |
| Alpine | ansible | 3.12 | 2.9.6-r0 | fixed |
| Alpine | ansible | 3.9 | 2.7.17-r0 | fixed |
| Alpine | ansible-base | 3.13 | 2.9.6-r0 | fixed |
| Alpine | ansible-base | 3.14 | 2.9.6-r0 | fixed |
| Ubuntu | ansible | pro | 2.8.3+dfsg-1 | vulnerable |
| Ubuntu | ansible | pro | 2.8.6+dfsg-1 | vulnerable |
| Ubuntu | ansible | pro | 2.9.2+dfsg-1 | vulnerable |
| Ubuntu | ansible | pro | 2.9.4+dfsg-1 | vulnerable |
| Ubuntu | ansible | pro | 2.9.6+dfsg-1 | vulnerable |
| Ubuntu | ansible | pro | 2.9.6+dfsg-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ansible | pro | 2.9.6+dfsg-1ubuntu0.1~esm2 | vulnerable |
| Ubuntu | ansible | pro | 2.9.6+dfsg-1ubuntu0.1~esm3 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ansible | source | sid | 2.9.7+dfsg-1 | unimportant | Not reported | Not reported |
| Debian | ansible | source | forky | 2.9.7+dfsg-1 | unimportant | Not reported | Not reported |
| Debian | ansible | source | trixie | 2.9.7+dfsg-1 | unimportant | Not reported | Not reported |
| Debian | ansible | source | bookworm | 2.9.7+dfsg-1 | unimportant | Not reported | Not reported |
| Alpine | ansible | apk | 3.10 | 2.8.9-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
| Alpine | ansible | apk | 3.11 | 2.9.6-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
| Alpine | ansible | apk | 3.12 | 2.9.6-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
| Alpine | ansible | apk | 3.9 | 2.7.17-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
| Alpine | ansible-base | apk | 3.13 | 2.9.6-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
| Alpine | ansible-base | apk | 3.14 | 2.9.6-r0 | Not reported | ALPINE-CVE-2020-1737 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ansible]Fixed
Details (2)
7.7.0+dfsg-3+deb12u1· all · bookwormFixed · Fixed:
2.9.7+dfsg-1dsa · ansible · debian · bookworm; dsa · ansible · debian · 12
7.7.0+dfsg-3+deb12u1· all · bookwormFixed · Fixed:
2.9.7+dfsg-1dsa · ansible · debian · bookworm; dsa · ansible · debian · 12
[Debian 13 (Trixie)]
- [ansible]Fixed
Details (2)
12.0.0+dfsg-0+deb13u1· all · trixieFixed · Fixed:
2.9.7+dfsg-1dsa · ansible · debian · 13
12.0.0+dfsg-0+deb13u1· all · trixieFixed · Fixed:
2.9.7+dfsg-1dsa · ansible · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_3309-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2020-1737]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2020-1737]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-1737]
- [https://security-tracker.debian.org/tracker/CVE-2020-1737]
- [https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-1737.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2024-3591.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]