Red Hat ansible-core.: code execution

A flaw was found in ansible-core. When installing a collection with

ansible-galaxy collection install, the archive extractor validates member

paths using lexical path normalisation (os.path.abspath) instead of resolving

symbolic links (os.path.realpath), and it performs no containment check on

symlink-typed directory members before creating them. A crafted collection

tarball can chain symlink directory entries so that a subsequent file member is

written outside the intended destination directory. This allows an attacker who

can get a victim to install a malicious collection to overwrite arbitrary files

with the privileges of the user running ansible-galaxy, leading to code

execution on the control node. This is a bypass of the fix for CVE-2020-10691.