Affected: Red Hat Migration Toolkit for Applications 8, Red Hat Migration Toolkit for Virtualization, Red Hat OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Discovery 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 and 9 more

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.