Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues. IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data has migrated to a new base image for the Operators used by our Speech Services. The following vulnerabilities...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-006)

The version of ansible installed on the remote host is prior to 2.9.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-006 advisory. An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive da...

SUSE CVE-2020-1736

A flaw was found in Ansible Engine when a file is moved using atomicmove primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions...

Security update for ansible (important)

openSUSE Security Update: Security update for ansible Announcement ID: openSUSE-SU-2022:0081-1 Rating: important References: 1099808 1112959 1118896 1126503 1137528 1157968 1157969 1164133 1164134 1164135 1164136 1164137 1164138 1164139 1164140 1165393 1166389 1167440 1167532 1167873 1171162...

ansible-role-chrony (>=1.0.3, <=1.3.0), ansible-role-collect-logs (>=1.1.0, <=1.2.0) +41 more potentially affected by CVE-2020-1736 via ansible (>=2.7.2, <=2.10.0)

ansible PYPI version =2.7.2, =1.0.3, =1.1.0, =2.0.0, =0.0.1.post1, =2.0.0b4, =6.0.0, =1.0.6, =2.1.0, =0.1.2, =0.1.3b11 - gufo-tower 2.0.0 and more Source cves: CVE-2020-1736 Source advisory: OSV:GHSA-X7JH-595Q-WQ82...

Fedora: Security Advisory for ansible (FEDORA-2020-d5e74bf9a0)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 32 : ansible (2020-d5e74bf9a0)

Update to upstream bugfix and security release 2.9.13. ---- Update to 2.9.12 upstream bugfix and security update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format...

Fedora 31 : ansible (2020-1e6eeadbb4)

Update to 2.9.12 upstream bugfix and security update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

GLSA-202006-11 : Ansible: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202006-11 Ansible: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Ansible. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for detail...

CVE-2020-1736

A flaw was found in Ansible Engine when a file is moved using atomicmove primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions...

ansiblerunnerapi (0.0.2), asset-inventory (0.0.7) +4 more potentially affected by CVE-2020-1736 via ansible (>=2.8.0, <=2.8.8)

ansible PYPI version =2.8.0, =0.1.2.dev20190704124001, =0.0.4, =0.1.0 - walletlib 0.1.0 Source cves: CVE-2020-1736 Source advisory: OSV:PYSEC-2020-8...

pyansible (>=1.0.0, <=1.0.3) potentially affected by CVE-2020-1736 via ansible (1.9.4)

ansible PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - pyansible =1.0.0, =1.0.3 Source cves: CVE-2020-1736 Source advisory: OSV:PYSEC-2020-8...

ansible-flow (0.1.0) potentially affected by CVE-2020-1736 via ansible (1.9.6)

ansible PYPI version 1.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ansible-flow 0.1.0 Source cves: CVE-2020-1736 Source advisory: OSV:PYSEC-2020-8...

ansible-vault-rekey (1.0.0), ansitom (>=0.0.1, <=0.0.2) +24 more potentially affected by CVE-2020-1736 via ansible (>=2.0.0.0, <=2.7.16)

ansible PYPI version =2.0.0.0, =0.0.1, =0.14.3.0rc1, =0.0.1.dev1287, =4.2.6, =4.3.0a0, =0.0.1, =1.3.0rc1, =0.4.0, =0.0.11, =2.0.0, =0.1.4, =0.2.0, =0.0.21a21, =0.0.22a2 and more Source cves: CVE-2020-1736 Source advisory: OSV:PYSEC-2020-8...

CVE-2020-1736

CVE-2020-1736 concerns Ansible Engine where moving a file with atomic_move cannot set the destination file mode. If the destination does not exist, the move can render the new file world-readable; if the file exists, permissions may be loosened before the move, potentially exposing sensitive data...