Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ansible-core-2.20 for openSUSE:Factory checked in at 2026-10-18 19:25:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ansible-core-2.20 (Old) and /work/SRC/openSUSE:Factory/.ansible-core-2.20.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ansible-core-2.20" Sun Oct 18 19:25:08 2026 rev:7 rq:1385742 version:2.20.10 Changes: -------- --- /work/SRC/openSUSE:Factory/ansible-core-2.20/ansible-core-2.20.changes 2026-10-08 13:28:35.097798046 +0200 +++ /work/SRC/openSUSE:Factory/.ansible-core-2.20.new.3698736/ansible-core-2.20.changes 2026-10-18 19:25:21.583874649 +0200 @@ -1,0 +2,11 @@ +Fri Oct 16 05:22:38 UTC 2026 - Harshvardhan Sharma <[email protected]> + +- Security fix for CVE-2026-89091 (bsc#1284847): path traversal in + ansible-galaxy collection install; a crafted collection tarball + could create directories or write files outside the collection + directory. Check directory members against the collection path and + normalise paths before the containment check. Backport of + gh#ansible/ansible#87660 (stable-2.20 gh#ansible/ansible#87668, commit 0eb9be1c). + * add ansible-core-CVE-2026-89091.patch + +------------------------------------------------------------------- New: ---- ansible-core-CVE-2026-89091.patch ----------(New B)---------- New: gh#ansible/ansible#87660 (stable-2.20 gh#ansible/ansible#87668, commit 0eb9be1c). * add ansible-core-CVE-2026-89091.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ansible-core-2.20.spec ++++++ --- /var/tmp/diff_new_pack.Vfqf5G/_old 2026-10-18 19:25:22.239901941 +0200 +++ /var/tmp/diff_new_pack.Vfqf5G/_new 2026-10-18 19:25:22.240901983 +0200 @@ -52,6 +52,8 @@ Source1: ansible_core-%{version}.tar.gz.sha256 # CVE-2026-16493 (bsc#1272369) Patch0: ansible-core-CVE-2026-16493.patch +# CVE-2026-89091 (bsc#1284847) +Patch1: ansible-core-CVE-2026-89091.patch BuildArch: noarch Provides: ansible-core = %{version} ++++++ ansible-core-CVE-2026-89091.patch ++++++ >From 0eb9be1ca453b6e651da157af8dbb09475e6d4d2 Mon Sep 17 00:00:00 2001 From: Sloane Hertel <[email protected]> Date: Wed, 14 Oct 2026 10:52:21 -0400 Subject: [PATCH] ansible-galaxy collection install - fix validating paths before extraction (#87660) (#87668) * ansible-galaxy collection install - validate directories and absolute linknames containing '..' are within the collection move tarball extraction tests into a dedicated tasks file replace unit tests testing directory extraction with integration tests (cherry picked from commit ed42c495548e21cbc6fe71de14265926c152d046) Co-authored-by: Martin Krizek <[email protected]> --- lib/ansible/galaxy/collection/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/ansible/galaxy/collection/__init__.py b/lib/ansible/galaxy/collection/__init__.py index 5656227e7e..6723d8d48c 100644 --- a/lib/ansible/galaxy/collection/__init__.py +++ b/lib/ansible/galaxy/collection/__init__.py @@ -1672,6 +1672,9 @@ def _extract_tar_dir(tar, dirname, b_dest): except KeyError: raise AnsibleError("Unable to extract '%s' from collection" % dirname) + if not _is_child_path(to_bytes(tar_member.name, errors='surrogate_or_strict'), b_dest): + raise AnsibleError(f"Cannot extract directory '{dirname}' in collection: path is outside of collection '{tar_member.name}'") + b_dir_path = os.path.join(b_dest, to_bytes(dirname, errors='surrogate_or_strict')) b_parent_path = os.path.dirname(b_dir_path) @@ -1776,13 +1779,16 @@ def _get_file_hash(b_path, filename): # type: (bytes, str) -> str def _is_child_path(path, parent_path, link_name=None): """ Checks that path is a path within the parent_path specified. """ b_path = to_bytes(path, errors='surrogate_or_strict') + b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') if link_name and not os.path.isabs(b_path): # If link_name is specified, path is the source of the link and we need to resolve the absolute path. b_link_dir = os.path.dirname(to_bytes(link_name, errors='surrogate_or_strict')) - b_path = os.path.abspath(os.path.join(b_link_dir, b_path)) + b_path = os.path.join(b_link_dir, b_path) + elif not os.path.isabs(b_path): + b_path = os.path.join(b_parent_path, b_path) - b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') + b_path = os.path.normpath(b_path) return b_path == b_parent_path or b_path.startswith(b_parent_path + to_bytes(os.path.sep)) -- 2.55.0
