CVE-2020-10691: 
Ansible Tower vulnerability analysis and mitigation

An archive traversal vulnerability (CVE-2020-10691) was discovered in Ansible Engine versions 2.9.x prior to 2.9.7, specifically affecting the ansible-galaxy collection install functionality. The vulnerability was discovered in March 2020 and patched in April 2020. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename, potentially allowing an attacker to overwrite any file within the system (CVE Details, Red Hat CVE).

The vulnerability exists in the ansible-galaxy collection install process where neither the install() function nor the called _extract_tar_file() performs any sanitization on the filename during the extraction of .tar.gz files. This implementation flaw could allow a specially crafted collection .tar.gz file to place files in arbitrary locations in the file system. The vulnerability affects Ansible Engine 2.9.6 and previous 2.9.x versions, while versions 2.8 and earlier are not affected as this functionality was introduced in version 2.9 (Red Hat Bugzilla).

An attacker could exploit this vulnerability to overwrite any file within the system by using a specially crafted collection .tar.gz file. This could potentially lead to system compromise through arbitrary file writes (Red Hat CVE).

The vulnerability requires an attacker to create a specially crafted collection .tar.gz file that would be processed by the ansible-galaxy collection install command. The vulnerability was discovered by Felix Fountein (Red Hat Bugzilla).

The vulnerability was fixed in Ansible Engine version 2.9.7. A possible mitigation for scenarios where upgrading is not immediately possible involves restricting file access control and directory write accesses for extracting tarball files, though this is only feasible when the destination path can be known and enforced beforehand. Red Hat released security updates RHSA-2020:1541 and RHSA-2020:1542 to address this vulnerability (Red Hat Advisory, GitHub PR).