{"id":"ALPINE-CVE-2019-3828","details":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.","modified":"2026-09-10T06:17:54.541528537Z","published":"2019-03-27T13:29:01.617Z","upstream":["CVE-2019-3828"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2019-3828"}],"affected":[{"package":{"name":"ansible","ecosystem":"Alpine:v3.10","purl":"pkg:apk/alpine/ansible?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.8.11-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible","ecosystem":"Alpine:v3.11","purl":"pkg:apk/alpine/ansible?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.9.7-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible","ecosystem":"Alpine:v3.12","purl":"pkg:apk/alpine/ansible?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.9.7-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible","ecosystem":"Alpine:v3.8","purl":"pkg:apk/alpine/ansible?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.15-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible","ecosystem":"Alpine:v3.9","purl":"pkg:apk/alpine/ansible?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.7.17-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible-base","ecosystem":"Alpine:v3.13","purl":"pkg:apk/alpine/ansible-base?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}},{"package":{"name":"ansible-base","ecosystem":"Alpine:v3.14","purl":"pkg:apk/alpine/ansible-base?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.7-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-3828.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}