A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positiona...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Debian:12ansible-core |
All versions→ Not listed |
Not listed |
| Debian:13ansible-core |
All versions→ Not listed |
Not listed |
| Debian:14ansible-core |
All versions→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security-tracker.debian.org