CVE-2024-9902

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: Nov 6, 2024
Source updated: Nov 6, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Ansible-core: ansible-core user may read/write unauthorized content

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

ansible-core

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: ansible-core
Package collection: https://github.com/ansible/ansible

ansible-core · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	custom	2.14.18rc1	Unavailable	None listed
2.15.0b1	`affected`	custom	2.15.13rc1	Unavailable	None listed
2.16.0b1	`affected`	custom	2.16.13rc1	Unavailable	None listed
2.17.0b1	`affected`	custom	2.17.6rc1	Unavailable	None listed
2.18.0b1	`affected`	custom	2.18.0rc2	Unavailable	None listed

Ansible Automation Platform Execution Environments

Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform/ansible-builder-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Ansible Automation Platform Execution Environments · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.1-96	`unaffected`	rpm	*	Unavailable	None listed

Ansible Automation Platform Execution Environments

Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform/ansible-builder-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Ansible Automation Platform Execution Environments · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.0.1-95	`unaffected`	rpm	*	Unavailable	None listed

Ansible Automation Platform Execution Environments

Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform/ee-29-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Ansible Automation Platform Execution Environments · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.9.27-32	`unaffected`	rpm	*	Unavailable	None listed

Ansible Automation Platform Execution Environments

Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform/ee-minimal-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Ansible Automation Platform Execution Environments · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.14.13-21	`unaffected`	rpm	*	Unavailable	None listed

Ansible Automation Platform Execution Environments

Vendor: Red Hat
Product: Ansible Automation Platform Execution Environments
Platforms: Unknown
Default status: affected
Package: ansible-automation-platform/ee-minimal-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Ansible Automation Platform Execution Environments · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.17.6-2	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.4 for RHEL 8

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 8
Platforms: Unknown
Default status: affected
Package: ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1:2.15.13-1.el8ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.4 for RHEL 9

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.4 for RHEL 9
Platforms: Unknown
Default status: affected
Package: ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.4 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1:2.15.13-1.el9ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.5 for RHEL 8

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
Platforms: Unknown
Default status: affected
Package: ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1:2.16.13-1.el8ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Ansible Automation Platform 2.5 for RHEL 9

Vendor: Red Hat
Product: Red Hat Ansible Automation Platform 2.5 for RHEL 9
Platforms: Unknown
Default status: affected
Package: ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1:2.16.13-1.el9ap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenStack Platform 17.1 for RHEL 9

Vendor: Red Hat
Product: Red Hat OpenStack Platform 17.1 for RHEL 9
Platforms: Unknown
Default status: affected
Package: openstack-ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat OpenStack Platform 17.1 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.14.2-4.6.el9ost	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Enterprise Linux 10

Vendor: Red Hat
Product: Red Hat Enterprise Linux 10
Platforms: Unknown
Default status: unaffected
Package: ansible-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.