CVE-2023-5115
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
CVE-2023-5115- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-36
- Updated
- 2026-11-07
EUVDEUVD-2023-3236
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
EUVD-2023-3236- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-jpvw-p8pr-9g2x
Ansible symlink attack vulnerability
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
GHSA-jpvw-p8pr-9g2x- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-22, CWE-36
- Updated
- 2026-11-02
NVD
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
CVE-2023-5115- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-36, CWE-22
- Updated
- 2026-11-07
OSVAZL-32279
CVE-2023-5115 affecting package ansible for versions less than 2.14.11-1
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
AZL-32279- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVAZL-34540
CVE-2023-5115 affecting package ansible for versions less than 2.17.0-1
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
AZL-34540- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
Show 15 moreShow less
OSV
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
CVE-2023-5115- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-07
OSVDEBIAN-CVE-2023-5115
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
DEBIAN-CVE-2023-5115- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-jpvw-p8pr-9g2x
Ansible symlink attack vulnerability
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
GHSA-jpvw-p8pr-9g2x- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-22, CWE-36
- Updated
- 2026-11-02
OSVOESA-2025-1125
ansible security update
Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. %if 0 Provides: ansible-python3 = - Obsoletes: ansible-python3 < - BuildRequires: python3-devel python3-setuptools BuildRequires: python3-PyYAML python3-paramiko python3-crypto python3-packaging BuildRequires: python3-pexpect python3-winrm BuildRequires: git-core %if %with_docs BuildRequires: python3-sphinx python3-sphinx-theme-alabaster asciidoc %endif BuildRequires: python3-six python3-nose python3-pytest python3-pytest-xdist BuildRequires: python3-pytest-mock python3-requests python3-coverage python3-mock BuildRequires: python3-boto3 python3-botocore python3-passlib python3-jinja2 Requires: python3-PyYAML python3-paramiko python3-crypto python3-setuptools python3-six Requires: python3-jinja2 sshpass python3-jmespath %description Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. This package installs versions of ansible that execute on Python3. %endif
Security Fix(es):
A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.(CVE-2022-3697)
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.(CVE-2023-5115)
- Record
OESA-2025-1125- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-1120
Ansible symlink attack vulnerability
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
PYSEC-2026-1120- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2023:5701
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
- Record
RHSA-2023:5701- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:5758
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Record
RHSA-2023:5758- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5115
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
- Record
UBUNTU-CVE-2023-5115- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13311-1 No score
ansible-core-2.15.5-1.1 on GA media
These are all security issues fixed in the ansible-core-2.15.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13311-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14251-1 No score
ansible-core-2.16-2.16.9-1.1 on GA media
These are all security issues fixed in the ansible-core-2.16-2.16.9-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14251-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14537-1 No score
ansible-core-2.17-2.17.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.17-2.17.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14537-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15638-1 No score
ansible-core-2.18-2.18.10-2.1 on GA media
These are all security issues fixed in the ansible-core-2.18-2.18.10-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15638-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15754-1 No score
ansible-core-2.19-2.19.4-1.1 on GA media
These are all security issues fixed in the ansible-core-2.19-2.19.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15754-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10945-1 No score
ansible-core-2.20-2.20.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.20-2.20.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10945-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12451-1 No score
ansible-core-2.21-2.21.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12451-1- Updated
- 2026-11-07
Affected products
- redhat ansible automation platform
- redhat ansible developer
- redhat ansible inside
- debian linux
- red hat ansible automation platform 1.2
- red hat ansible automation platform 2.3 for rhel 8
- red hat ansible automation platform 2.3 for rhel 9
- red hat ansible automation platform 2.4 for rhel 8
- red hat ansible automation platform 2.4 for rhel 9
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansiblePyPI |
before 8.5.0 | 8.5.0 |
ansibleAzure Linux:2 |
before 2.14.11-1 | 2.14.11-1 |
ansibleAzure Linux:3 |
before 2.17.0-1 | 2.17.0-1 |
ansibleDebian:12 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:13 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:14 |
before 5.4.0-1 | 5.4.0-1 |
ansible-coreDebian:12 |
before 2.14.16-0+deb12u1, plus listed versions 2.14.10-12.14.11-12.14.11-22.14.13-12.14.3-1 Show 5 moreShow less2.14.6-12.14.7-12.14.8-12.14.9-12.14.9-2 |
2.14.16-0+deb12u1 |
ansible-coreDebian:13 |
before 2.14.11-1 | 2.14.11-1 |
ansible-coreDebian:14 |
before 2.14.11-1 | 2.14.11-1 |
ansibleDebian:10 From an advisory covering 8 CVEs |
before 2.7.7+dfsg-1+deb10u2, plus listed versions 2.7.7+dfsg-12.7.7+dfsg-1+deb10u1 |
2.7.7+dfsg-1+deb10u2 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansiblePyPI |
before 8.5.0, plus listed versions 1.01.11.21.2.11.2.2 Show 45 moreShow less1.2.31.3.01.3.11.3.21.3.31.3.41.41.4.11.4.21.4.31.4.41.4.51.51.5.11.5.21.5.31.5.41.5.51.61.6.11.6.101.6.21.6.31.6.41.6.51.6.61.6.71.6.81.6.91.71.7.11.7.21.81.8.11.8.21.8.31.8.41.9.01.9.0.11.9.11.9.21.9.31.9.41.9.51.9.6 |
8.5.0 |
ansibleopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.9.27-7.oe2403sp1 | 2.9.27-7.oe2403sp1 |
ansibleopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.5.5-8.oe2003sp4 | 2.5.5-8.oe2003sp4 |
ansibleopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.9.27-6.oe2203sp3 | 2.9.27-6.oe2203sp3 |
ansibleopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.9.27-6.oe2203sp4 | 2.9.27-6.oe2203sp4 |
ansibleopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 2.9.27-7.oe2403 | 2.9.27-7.oe2403 |
ansible-coreRed Hat:ansible_automation_platform_developer:2.3::el8 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el8ap | 0:2.14.11-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.3::el8 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el8ap | 0:2.14.11-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform:2.3::el8 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el8ap | 0:2.14.11-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_developer:2.3::el9 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el9ap | 0:2.14.11-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.3::el9 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el9ap | 0:2.14.11-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform:2.3::el9 From an advisory covering 2 CVEs |
before 0:2.14.11-1.el9ap | 0:2.14.11-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.3::el8 From an advisory covering 2 CVEs |
before 0:4.3.16-1.el8ap | 0:4.3.16-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.3::el9 From an advisory covering 2 CVEs |
before 0:4.3.16-1.el9ap | 0:4.3.16-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el8ap | 0:2.15.5-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el8ap | 0:2.15.5-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el8ap | 0:2.15.5-1.el8ap |
ansible-coreRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el9ap | 0:2.15.5-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el9ap | 0:2.15.5-1.el9ap |
ansible-coreRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs |
before 0:2.15.5-1.el9ap | 0:2.15.5-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs |
before 0:4.4.6-1.el8ap | 0:4.4.6-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs |
before 0:4.4.6-1.el9ap | 0:4.4.6-1.el9ap |
python39-djangoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs |
before 0:3.2.22-1.el8ap | 0:3.2.22-1.el8ap |
python3x-djangoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 3 CVEs |
before 0:3.2.22-1.el8ap | 0:3.2.22-1.el8ap |
python-djangoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs |
before 0:3.2.22-1.el9ap | 0:3.2.22-1.el9ap |
python3-djangoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 3 CVEs |
before 0:3.2.22-1.el9ap | 0:3.2.22-1.el9ap |
ansibleUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-1 Show 5 moreShow less1.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm11.5.4+dfsg-1ubuntu0.1~esm21.5.4+dfsg-1ubuntu0.1~esm3 |
None known |
ansibleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.1 Show 8 moreShow less2.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm12.0.0.2-2ubuntu1.3+esm22.0.0.2-2ubuntu1.3+esm32.0.0.2-2ubuntu1.3+esm42.0.0.2-2ubuntu1.3+esm52.0.0.2-2ubuntu1.3+esm6 |
None known |
ansibleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1 Show 4 moreShow less2.5.1+dfsg-1ubuntu0.1+esm22.5.1+dfsg-1ubuntu0.1+esm32.5.1+dfsg-1ubuntu0.1+esm42.5.1+dfsg-1ubuntu0.1+esm5 |
None known |
ansibleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm12.9.6+dfsg-1ubuntu0.1~esm22.9.6+dfsg-1ubuntu0.1~esm3 |
None known |
ansible-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.0-12.12.0-1ubuntu0.1 |
None known |
ansibleUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 |
None known |
ansibleUbuntu:24.04:LTS |
All versions, plus listed versions 7.7.0+dfsg-17.7.0+dfsg-39.2.0+dfsg-0ubuntu49.2.0+dfsg-0ubuntu5 |
None known |
ansible-coreUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2 |
None known |
ansibleUbuntu:25.10 |
All versions, plus listed versions 11.2.0+dfsg-112.0.0~a2+dfsg-112.0.0~a4+dfsg-112.0.0~a6+dfsg-112.0.0~b1+dfsg-1 |
None known |
ansible-coreUbuntu:25.10 |
All versions, plus listed versions 2.18.1-4ubuntu12.19.0~beta4-1ubuntu12.19.0-1ubuntu1 |
None known |
ansibleUbuntu:26.10 |
All versions, plus listed versions 13.1.0+dfsg-1ubuntu113.4.0+dfsg-1 |
None known |
ansible-coreUbuntu:26.10 |
All versions, plus listed versions 2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1 |
None known |
ansibleUbuntu:26.04:LTS |
All versions, plus listed versions 12.0.0~b1+dfsg-112.0.0+dfsg-112.2.0+dfsg-113.1.0+dfsg-113.1.0+dfsg-1ubuntu1 |
None known |
ansible-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-1ubuntu12.19.4-12.20.1-1 |
None known |
ansible-coreopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.16.9-1.1 | 2.16.9-1.1 |
ansible-core-2.17openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.17.6-1.1 | 2.17.6-1.1 |
ansible-core-2.18openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.18.10-2.1 | 2.18.10-2.1 |
ansible-core-2.19openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.19.4-1.1 | 2.19.4-1.1 |
ansible-core-2.20openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.20.6-1.1 | 2.20.6-1.1 |
ansible-core-2.21openSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 2.21.6-1.1 | 2.21.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | CVE List, EUVD, NVD, OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5115 is a medium vulnerability (CVSS 6.3) in Redhat Ansible Automation Platform, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in ansible 8.5.0.
References
access.redhat.com/errata/RHSA-2023:5701
bugzilla.redhat.com/show_bug.cgi?id=2233810
lists.debian.org/debian-lts-announce/2023/12/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2023-5115
Show 36 moreShow less
github.com/ansible/ansible/commit/1e930684bc0a76ec3d094cd326738ad26416541c
security-tracker.debian.org/tracker/CVE-2023-5115
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1125
pypi.org/project/ansible
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5701.json
cve.org/CVERecord?id=CVE-2023-5115
djangoproject.com/weblog/2023/sep/04/security-releases
ubuntu.com/security/CVE-2023-5115
suse.com/security/cve/CVE-2023-5115
lists.opensuse.org/archives/list/[email protected]/thread/2Y6RFLPB54N7XR7AP7A2DEXGLBEDEQJU
Left out here: 282 versions. The JSON record has them.