title: Red Hat Security Advisory: Ansible security and bug fix update (2.9.7)
description: ansible: insecure temporary directory when running become_user from become directive ansible: path injection on dest parameter in fetch module ansible: Extract-Zip function in win_unzip module does not check extracted path ansible: svn module leaks password when specified as a parameter ansible: secrets readable after ansible-vault edit ansible: Information disclosure issue in ldap_attr and ldap_entry modules Ansible: kubectl connection plugin leaks sensitive information Ansible: code injection when using ansible_facts as a subkey Ansible: modules which use files encrypted with vault are not properly cleaned up Ansible: archive traversal vulnerability in ansible-galaxy collection install
cpes: cpe:/a:redhat:ansible_engine:2::el7 cpe:/a:redhat:ansible_engine:2::el8