Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ansible-core for openSUSE:Factory checked in at 2026-10-18 19:25:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ansible-core (Old) and /work/SRC/openSUSE:Factory/.ansible-core.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ansible-core" Sun Oct 18 19:25:07 2026 rev:67 rq:1385741 version:2.21.5 Changes: -------- --- /work/SRC/openSUSE:Factory/ansible-core/ansible-core.changes 2026-10-08 13:28:41.061047606 +0200 +++ /work/SRC/openSUSE:Factory/.ansible-core.new.3698736/ansible-core.changes 2026-10-18 19:25:20.670836665 +0200 @@ -1,0 +2,11 @@ +Fri Oct 16 05:22:38 UTC 2026 - Harshvardhan Sharma <[email protected]> + +- Security fix for CVE-2026-89091 (bsc#1284847): path traversal in + ansible-galaxy collection install; a crafted collection tarball + could create directories or write files outside the collection + directory. Check directory members against the collection path and + normalise paths before the containment check. Backport of + gh#ansible/ansible#87660 (stable-2.21 gh#ansible/ansible#87667, commit 74dbbd01). + * add ansible-core-CVE-2026-89091.patch + +------------------------------------------------------------------- New: ---- ansible-core-CVE-2026-89091.patch ----------(New B)---------- New: gh#ansible/ansible#87660 (stable-2.21 gh#ansible/ansible#87667, commit 74dbbd01). * add ansible-core-CVE-2026-89091.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ansible-core.spec ++++++ --- /var/tmp/diff_new_pack.jlxA2q/_old 2026-10-18 19:25:21.442868783 +0200 +++ /var/tmp/diff_new_pack.jlxA2q/_new 2026-10-18 19:25:21.443868825 +0200 @@ -52,6 +52,8 @@ Source1: ansible_core-%{version}.tar.gz.sha256 # CVE-2026-16493 (bsc#1272369) Patch0: ansible-core-CVE-2026-16493.patch +# CVE-2026-89091 (bsc#1284847) +Patch1: ansible-core-CVE-2026-89091.patch BuildArch: noarch # cannot be installed with ansible < 3 or ansible-base ++++++ ansible-core-CVE-2026-89091.patch ++++++ >From 74dbbd014e4084b141ce4c28efb4ce0e5904e4d6 Mon Sep 17 00:00:00 2001 From: Sloane Hertel <[email protected]> Date: Wed, 14 Oct 2026 10:52:11 -0400 Subject: [PATCH] ansible-galaxy collection install - fix validating paths before extraction (#87660) (#87667) * ansible-galaxy collection install - validate directories and absolute linknames containing '..' are within the collection move tarball extraction tests into a dedicated tasks file replace unit tests testing directory extraction with integration tests (cherry picked from commit ed42c495548e21cbc6fe71de14265926c152d046) Co-authored-by: Martin Krizek <[email protected]> --- lib/ansible/galaxy/collection/__init__.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/ansible/galaxy/collection/__init__.py b/lib/ansible/galaxy/collection/__init__.py index 3a4d1da506..d65c83414b 100644 --- a/lib/ansible/galaxy/collection/__init__.py +++ b/lib/ansible/galaxy/collection/__init__.py @@ -1682,6 +1682,9 @@ def _extract_tar_dir(tar, dirname, b_dest): except KeyError: raise AnsibleError("Unable to extract '%s' from collection" % dirname) + if not _is_child_path(to_bytes(tar_member.name, errors='surrogate_or_strict'), b_dest): + raise AnsibleError(f"Cannot extract directory '{dirname}' in collection: path is outside of collection '{tar_member.name}'") + b_dir_path = os.path.join(b_dest, to_bytes(dirname, errors='surrogate_or_strict')) b_parent_path = os.path.dirname(b_dir_path) @@ -1786,13 +1789,16 @@ def _get_file_hash(b_path, filename): # type: (bytes, str) -> str def _is_child_path(path, parent_path, link_name=None): """ Checks that path is a path within the parent_path specified. """ b_path = to_bytes(path, errors='surrogate_or_strict') + b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') if link_name and not os.path.isabs(b_path): # If link_name is specified, path is the source of the link and we need to resolve the absolute path. b_link_dir = os.path.dirname(to_bytes(link_name, errors='surrogate_or_strict')) - b_path = os.path.abspath(os.path.join(b_link_dir, b_path)) + b_path = os.path.join(b_link_dir, b_path) + elif not os.path.isabs(b_path): + b_path = os.path.join(b_parent_path, b_path) - b_parent_path = to_bytes(parent_path, errors='surrogate_or_strict') + b_path = os.path.normpath(b_path) return b_path == b_parent_path or b_path.startswith(b_parent_path + to_bytes(os.path.sep)) -- 2.55.0
