Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
suseSuseOPENSUSE-SU-2019:0238-1
HistoryFeb 23, 2019 - 12:00 a.m.

Security update for ansible (moderate)

2019-02-2300:00:00
lists.opensuse.org
257

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.025 Low

EPSS

Percentile

89.0%

JSON

An update that fixes 6 vulnerabilities is now available.

Description:

This update for ansible fixes the following issues:

Security vulnerabilities fixed:

  • CVE-2018-16876: Respect no_log on retry and high verbosity (bsc#1118896)
  • CVE-2018-16859: Windows - prevent sensitive content from appearing in
    scriptblock logging (bsc#1116587)
  • CVE-2018-10855: Fixed the honouration of the no_log option with failed
    task iterations (boo#1097775)
  • CVE-2017-7466: Fixed an input validation vulnerability in Ansible’s
    handling
    of data sent from client systems
  • CVE-2017-7481: Fixed a security issue with lookup return not tainting
    the jinja2 environment (bsc#1038785)

Other bug fixes and changes:

  • Update to version 2.7.6

    • Added log message at -vvvv when using netconf connection listing
      connection details.
    • Changes how ansible-connection names socket lock files. They now use
      the same name as the socket itself, and as such do not lock other
      attempts on connections to the same host, or cause issues with
      overly-long hostnames.
    • Fix mandatory statement error for junos modules
      (https://github.com/ansible/ansible/pull/50138)
    • Moved error in netconf connection plugin from at import to on
      connection.
    • This reverts some changes from commit 723daf3. If a line is found in
      the file, exactly or via regexp matching, it must not be added again.
      insertafter/insertbefore options are used only when a line is to be
      inserted, to specify where it must be added.
    • allow using openstack inventory plugin w/o a cache
    • callbacks - Do not filter out exception, warnings, deprecations on
      failure when using debug
      (https://github.com/ansible/ansible/issues/47576)
    • certificate_complete_chain - fix behavior when invalid file is parsed
      while reading intermediate or root certificates.
    • copy - Ensure that the src file contents is converted to unicode in
      diff information so that it is properly wrapped by AnsibleUnsafeText
      to prevent unexpected templating of diff data in Python3
      (https://github.com/ansible/ansible/issues/45717)
    • correct behaviour of verify_file for vmware inventory plugin, it was
      always returning True
    • dnf - fix issue where conf_file was not being loaded properly
    • dnf - fix update_cache combined with install operation to not cause
      dnf transaction failure
    • docker_container - fix network_mode idempotency if the
      container:<container-name> form is used (as opposed to
      container:<container-id>)
      (https://github.com/ansible/ansible/issues/49794)
    • docker_container - warning when non-string env values are found,
      avoiding YAML parsing issues. Will be made an error in Ansible 2.8.
      (https://github.com/ansible/ansible/issues/49802)
    • docker_swarm_service - Document labels and container_labels with
      correct type.
    • docker_swarm_service - Document limit_memory and reserve_memory
      correctly on how to specify sizes.
    • docker_swarm_service - Document minimal API version for configs and
      secrets.
    • docker_swarm_service - fix use of Docker API so that services are not
      detected as present if there is an existing service whose name is a
      substring of the desired service
    • docker_swarm_service - fixing falsely reporting update_order as
      changed when option is not used.
    • document old option that was initally missed
    • ec2_instance now respects check mode
      https://github.com/ansible/ansible/pull/46774
    • fix for network_cli - ansible_command_timeout not working as expected
      (#49466)
    • fix handling of firewalld port if protocol is missing
    • fix lastpass lookup failure on python 3
      (https://github.com/ansible/ansible/issues/42062)
    • flatpak - Fixed Python 2/3 compatibility
    • flatpak - Fixed issue where newer versions of flatpak failed on
      flatpak removal
    • flatpak_remote - Fixed Python 2/3 compatibility
    • gcp_compute_instance - fix crash when the instance metadata is not set
    • grafana_dashboard - Fix a pair of unicode string handling issues with
      version checking (https://github.com/ansible/ansible/pull/49194)
    • host execution order - Fix reverse_inventory not to change the order
      of the items before reversing on python2 and to not backtrace on
      python3
    • icinga2_host - fixed the issue with not working use_proxy option of
      the module.
    • influxdb_user - An unspecified password now sets the password to
      blank, except on existing users. This previously caused an unhandled
      exception.
    • influxdb_user - Fixed unhandled exception when using invalid login
      credentials (https://github.com/ansible/ansible/issues/50131)
    • openssl_* - fix error when path contains a file name without path.
    • openssl_csr - fix problem with idempotency of keyUsage option.
    • openssl_pkcs12 - now does proper path expansion for ca_certificates.
    • os_security_group_rule - os_security_group_rule doesn’t exit properly
      when secgroup doesn’t exist and state=absent
      (https://github.com/ansible/ansible/issues/50057)
    • paramiko_ssh - add auth_timeout parameter to ssh.connect when
      supported by installed paramiko version. This will prevent
      “Authentication timeout” errors when a slow authentication step (>30s)
      happens with a host (https://github.com/ansible/ansible/issues/42596)
    • purefa_facts and purefb_facts now correctly adds facts into main
      ansible_fact dictionary (https://github.com/ansible/ansible/pull/50349)
    • reboot - add appropriate commands to make the plugin work with VMware
      ESXi (https://github.com/ansible/ansible/issues/48425)
    • reboot - add support for rebooting AIX
      (https://github.com/ansible/ansible/issues/49712)
    • reboot - gather distribution information in order to support Alpine
      and other distributions
      (https://github.com/ansible/ansible/issues/46723)
    • reboot - search common paths for the shutdown command and use the full
      path to the binary rather than depending on the PATH of the remote
      system (https://github.com/ansible/ansible/issues/47131)
    • reboot - use a common set of commands for older and newer Solaris and
      SunOS variants (https://github.com/ansible/ansible/pull/48986)
    • redfish_utils - fix reference to local variable ‘systems_service’
    • setup - fix the rounding of the ansible_memtotal_mb value on VMWare
      vm’s (https://github.com/ansible/ansible/issues/49608)
    • vultr_server - fixed multiple ssh keys were not handled.
    • win_copy - Fix copy of a dir that contains an empty directory -
      https://github.com/ansible/ansible/issues/50077
    • win_firewall_rule - Remove invalid ‘bypass’ action
    • win_lineinfile - Fix issue where a malformed json block was returned
      causing an error
    • win_updates - Correctly report changes on success

  • update to version 2.7.5

  • update to version 2.7.4

    • powershell - add lib/ansible/executor/powershell to the packaging data

  • update to version 2.7.3

    • Fix the issue that FTD HTTP API retries authentication-related HTTP
      requests
    • Fix the issue that module fails when the Swagger model does not have
      required fields
    • Fix the issue with comparing string-like objects
    • Fix using omit on play keywords
    • apt_key - Disable TTY requirement in GnuPG for the module to work
      correctly when SSH pipelining is enabled
    • better error message when bad type in config, deal with EVNAR= more
      gracefully
    • configuration retrieval would fail on non primed plugins
    • cs_template - Fixed a KeyError on state=extracted
    • docker_container - fix idempotency problems with docker-py caused by
      previous init idempotency fix
    • docker_container - fix interplay of docker-py version check with
      argument_spec validation improvements
    • docker_network - driver_options containing Python booleans would cause
      Docker to throw exceptions
    • ec2_group - Fix comparison of determining which rules to purge by
      ignoring descriptions
    • pip module - fix setuptools/distutils replacement
    • sysvinit - enabling a service should use “defaults” if no runlevels
      are specified

  • update to version 2.7.2

    • Minor changes

  • update to 2.7.1

    • Minor changes

  • update to 2.7.0

    • Allow config to enable native jinja types
    • Remove support for simplejson
    • yum and dnf modules now at feature parity
    • Security Fix - avoid loading host/group vars from cwd when not
      specifying a playbook or playbook base dir
    • Security Fix - avoid using ansible.cfg in a world writable dir
    • Some connection exception would cause no_log specified on a task to be
      ignored (stdout info disclosure)
    • Fix glob path of rc.d (SUSE-specific)
    • Fix lambda_policy updates
    • Fix alt linux detection/matching

  • update to 2.6.4

    • Add md5sum check in nxos_file_copy module
    • Allow arbitrary log_driver for docker_container
    • Fix Python2.6 regex bug terminal plugin nxos, iosxr
    • Fix check_mode in nxos_static_route module
    • Fix glob path of rc.d Some distribtuions like SUSE has the rc%.d
      directories under /etc/init.d
    • Fix network config diff issue for lines
    • Fixed an issue where ansible_facts.pkg_mgr would incorrectly set to
      zypper on Debian/Ubuntu systems that happened to have the command
      installed
    • The docker_* modules respect the DOCKER_* environment variables again
    • The fix for CVE-2018-10875 prints out a warning message about skipping
      a config file from a world writable current working directory.
      However, if the user is in a world writable current working directory
      which does not contain a config file, it should not print a warning
      message. This release fixes that extaneous warning.
    • To resolve nios_network issue where vendor-encapsulated-options can
      not have a use_option flag.
    • To resolve the issue of handling exception for Nios lookup gracefully.
    • always correctly template no log for tasks
    • ansible-galaxy - properly list all roles in roles_path
    • basic.py - catch ValueError in case a FIPS enabled platform raises
      this exception
    • docker_container: fixing working_dir idempotency problem
    • docker_container: makes unit parsing for memory sizes more consistent,
      and fixes idempotency problem when kernel_memory is set
    • fix example code for AWS lightsail documentation
    • fix the enable_snat parameter that is only supposed to be used by an
      user with the right policies.
    • fixes docker_container check and debug mode
    • improves docker_container idempotency
    • ios_l2_interface - fix bug when list of vlans ends with comma
    • ios_l2_interface - fix issue with certain interface types
    • ios_user - fix unable to delete user admin issue
    • ios_vlan - fix unable to work on certain interface types issue
    • nxos_facts test lldp feature and fix nxapi check_rc
    • nxos_interface port-channel idempotence fix for mode
    • nxos_linkagg mode fix
    • nxos_system idempotence fix
    • nxos_vlan refactor to support non structured output
    • one_host - fixes settings via environment variables
    • use retry_json nxos_banner
    • user - Strip trailing comments in /etc/default/passwd
    • user - when creating a new user without an expiration date, properly
      set no expiration rather that expirining the account
    • win_domain_computer - fixed deletion of computer active directory
      object that have dependent objects
    • win_domain_computer - fixed error in diff_support
    • win_domain_computer - fixed error when description parameter is empty
    • win_psexec - changed code to not escape the command option when
      building the args
    • win_uri – Fix support for JSON output when charset is set
    • win_wait_for - fix issue where timeout doesn’t wait unless
      state=drained

  • update to 2.6.3

    • Fix lxd module to be idempotent when the given configuration for the
      lxd container has not changed
    • Fix setting value type to str to avoid conversion during template
      read. Fix Idempotency in case of ‘no key’.
    • Fix the mount module’s handling of swap entries in fstab
    • The fix for (CVE-2018-10875) prints out a warning message about
      skipping a config file from a world writable current working
      directory. However, if the user explicitly specifies that the config
      file should be used via the ANSIBLE_CONFIG environment variable then
      Ansible would honor that but still print out the warning message. This
      has been fixed so that Ansible honors the user’s explicit wishes and
      does not print a warning message in that circumstance.
    • To fix the bug where existing host_record was deleted when existing
      record name is used with different IP.
    • VMware handle pnic in proxyswitch
    • fix azure security group cannot add rules when purge_rule set to false.
    • fix azure_rm_deployment collect tags from existing Resource Group.
    • fix azure_rm_loadbalancer_facts list takes at least 2 arguments.
    • fix for the bundled selectors module (used in the ssh and local
      connection plugins) when a syscall is restarted after being
      interrupted by a signal
    • get_url - fix the bug that get_url does not change mode when checksum
      matches
    • nicer error when multiprocessing breaks
    • openssl_certificate - Convert valid_date to bytes for conversion
    • openstack_inventory.py dynamic inventory file fixed the plugin to the
      script so that it will work with current ansible-inventory. Also
      redirect stdout before dumping the ouptput, because not doing so will
      cause JSON parse errors in some cases.
    • slack callback - Fix invocation by looking up data from cli.options
    • sysvinit module: handle values of optional parameters. Don’t disable
      service when enabled parameter isn’t set. Fix command when arguments
      parameter isn’t set.
    • vars_prompt - properly template play level variables in vars_prompt
    • win_domain - ensure the Netlogon service is up and running after
      promoting host to controller
    • win_domain_controller - ensure the Netlogon service is up and running
      after promoting host to controller

  • update to 2.6.2

    • Add text output along with structured output in nxos_facts
    • Allow more than one page of results by using the right pagination
      indicator (‘NextMarker’ instead of ‘NextToken’).
    • Fix an atomic_move error that is ‘true’, but misleading. Now we show
      all 3 files involved and clarify what happened.
    • Fix eos_l2_interface eapi.
    • Fix fetching old style facts in junos_facts module
    • Fix get_device_info nxos zero or more whitespace regex
    • Fix nxos CI failures
    • Fix nxos_nxapi default http behavior
    • Fix nxos_vxlan_vtep_vni
    • Fix regex network_os_platform nxos
    • Refactor nxos cliconf get_device_info for non structured
      output supported devices
    • To fix the NoneType error raised in ios_l2_interface when Access Mode
      VLAN is unassigned
    • emtpy host/group name is an error
    • fix default SSL version for docker modules
    • fix mail module when using starttls
    • fix nmap config example
    • fix ps detection of service
    • fix the remote tmp folder permissions issue when becoming a non admin
      user
    • fix typoe in sysvinit that breaks update.rc-d detection
    • fixes docker_container compatibilty with docker-py < 2.2
    • get_capabilities in nxapi module_utils should not return empty
      dictionary
    • inventory - When using an inventory directory, ensure extension
      comparison uses text types
    • ios_vlan - fix unable to identify correct vlans issue
    • nxos_facts warning message improved
    • openvswitch_db - make ‘key’ argument optional
    • pause - do not set stdout to raw mode when redirecting to a file
    • pause - nest try except when importing curses to gracefully fail if
      curses is not present
    • plugins/inventory/openstack.py - Do not create group with empty name
      if region is not set
    • preseve delegation info on nolog
    • remove ambiguity when it comes to ‘the source’
    • remove dupes from var precedence
    • restores filtering out conflicting facts
    • user - fix bug that resulted in module always reporting a change when
      specifiying the home directory on FreeBSD
    • user - use correct attribute name in FreeBSD for creat_home
    • vultr - Do not fail trying to load configuration from ini files if
      required variables have been set as environment variables.
    • vyos_command correcting conditionals looping
    • win_chocolatey - enable TLSv1.2 support when downloading the
      Chocolatey installer
    • win_reboot - fix for handling an already scheduled reboot and other
      minor log formatting issues
    • win_reboot - fix issue when overridding connection timeout hung the
      post reboot uptime check
    • win_reboot - handle post reboots when running test_command
    • win_security_policy - allows an empty string to reset a policy value
    • win_share - discard any cmdlet output we don’t use to ensure only the
      return json is received by Ansible
    • win_unzip - discard any cmdlet output we don’t use to ensure only the
      return json is received by Ansible
    • win_updates - fixed module return value is lost in error in some cases
    • win_user - Use LogonUser to validate the password as it does not rely
      on SMB/RPC to be available
    • Security Fix - avoid loading host/group vars from cwd when not
      specifying a playbook or playbook base dir
    • Security Fix - avoid using ansible.cfg in a world writable dir.
    • Fix junos_config confirm commit timeout issue
      (https://github.com/ansible/ansible/pull/41527)
    • file module - The touch subcommand had its diff output broken during
      the 2.6.x development cycle. This is now fixed.
    • inventory manager - This fixes required options being populated before
      the inventory config file is read, so the required options may be set
      in the config file.
    • nsupdate - allow hmac-sha384
      https://github.com/ansible/ansible/pull/42209
    • win_domain - fixes typo in one of the AD cmdlets
      https://github.com/ansible/ansible/issues/41536
    • win_group_membership - uses the internal Ansible SID conversion logic
      and uses that when comparing group membership instead of the name

  • use fdupes to save some space in python_sitelib

  • define BuildRoot on older distributions like SLE-11

  • be a bit more flexible with the ending of manpage files to allow Fedora
    builds to succeed

  • updated to latest release 2.6.0

  • New Plugins:

    • Callback:
      • cgroup_memory_recap
      • grafana_annotations
      • sumologic
    • Connection:
      • httpapi
    • Inventory:
      • foreman
      • gcp_compute
      • generator
      • nmap
    • Lookup:
      • onepassword
      • onepassword_raw

  • Modules updates too many to mention here please look at package
    documentation directory (/usr/share/doc/packages/…/changelogs)

  • bug fixes:

  • use python3 on (open)SUSE 15 or newer

  • Update to 2.5.5

    • Changed the admin_users config option to not include “admin” by
      default as admin is frequently used for a non-privileged account
    • aws_s3 - add async support to the action plugin
    • aws_s3 - fix decrypting vault files
    • ec2_ami - cast the device_mapping volume size to an int
    • eos_logging - fix idempotency issues
    • cache plugins - A cache timeout of 0 means the cache will not expire.
    • ios_logging - fix idempotency issues
    • ios/nxos/eos_config - don’t retrieve config in running_config when
      config is provided for diff
    • nxos_banner - fix multiline banner issue
    • nxos terminal plugin - fix output truncation
    • nxos_l3_interface - fix no switchport issue with loopback and svi
      interfaces
    • nxos_snapshot - fix compare_option

  • update to 2.2.3.0 (boo#1056094)

    • Various minor bug fixes

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

  • openSUSE Backports SLE-15:

    zypper in -t patch openSUSE-2019-238=1

OSVersionArchitecturePackageVersionFilename
openSUSE Backports SLE15noarch<  openSUSE Backports SLE-15 (noarch):- openSUSE Backports SLE-15 (noarch):.noarch.rpm

Related

openvas 20
fedora 14
nessus 43
redhat 29
debian 3
suse 4
osv 20
ubuntu 1
alpinelinux 4
veracode 11
redhatcve 4
ubuntucve 5
cve 7
github 6
prion 6
debiancve 6
attackerkb 1
freebsd 1
mageia 4
photon 2
openvas
openvas
Fedora Update for ansible FEDORA-2018-615705632d
2018-12-24 00:00:00
Debian: Security Advisory (DSA-4396-1)
2019-02-18 00:00:00
Ubuntu: Security Advisory (USN-4072-1)
2019-07-25 00:00:00
fedora
fedora
[SECURITY] Fedora 28 Update: ansible-2.7.5-1.fc28
2018-12-24 01:48:57
[SECURITY] Fedora 28 Update: ansible-2.6.1-1.fc28
2018-07-12 14:21:51
[SECURITY] Fedora 27 Update: ansible-2.6.1-1.fc27
2018-07-16 17:38:00
nessus
nessus
RHEL 7 : Storage Server (RHSA-2017:1334)
2017-05-30 00:00:00
RHEL 7 : ansible (RHSA-2017:1499)
2017-06-22 00:00:00
RHEL 7 : ansible and openshift-ansible (RHSA-2017:1244)
2018-12-04 00:00:00
redhat
redhat
(RHSA-2017:1499) Important: ansible security update
2017-06-19 13:23:31
(RHSA-2017:1244) Important: ansible and openshift-ansible security and bug fix update
2017-05-17 17:20:35
(RHSA-2017:1334) Important: ansible security update
2017-05-25 16:56:01
debian
debian
[SECURITY] [DSA 4396-1] ansible security update
2019-02-19 21:54:58
[SECURITY] [DLA 2535-1] ansible security update
2021-01-27 21:14:42
[SECURITY] [DLA 1923-1] ansible security update
2019-09-16 12:23:29
suse
suse
Security update for ansible (moderate)
2019-04-03 00:00:00
Security update for ansible (moderate)
2019-06-27 00:00:00
Security update for ansible (moderate)
2019-08-14 00:00:00
osv
osv
ansible - security update
2019-02-19 00:00:00
PYSEC-2018-43
2018-07-13 22:29:00
PYSEC-2018-40
2018-06-22 13:29:00
ubuntu
ubuntu
Ansible vulnerabilities
2019-07-24 00:00:00
alpinelinux
alpinelinux
CVE-2018-16859
2018-11-29 18:29:00
CVE-2018-10855
2018-07-03 01:29:00
CVE-2018-10875
2018-07-13 22:29:00
veracode
veracode
Arbitrary Code Execution
2018-07-16 07:43:28
Information Disclosure
2018-12-05 03:07:39
Information Disclosure
2019-01-15 09:20:02
redhatcve
redhatcve
CVE-2018-10875
2021-03-20 21:24:25
CVE-2018-16859
2019-10-10 05:33:52
CVE-2018-10855
2019-10-08 21:40:21
ubuntucve
ubuntucve
CVE-2017-7481
2018-07-19 00:00:00
CVE-2018-10855
2018-07-03 00:00:00
CVE-2018-10875
2018-07-13 00:00:00
cve
cve
CVE-2018-16859
2018-11-29 18:29:00
CVE-2017-7481
2018-07-19 13:29:00
CVE-2017-7466
2018-06-22 13:29:00
github
github
Ansible exposes sensitive data in log files and on the terminal
2018-10-10 17:23:20
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
2022-05-14 01:14:00
Ansible fails to properly mark lookup-plugin results as unsafe
2018-09-06 03:28:50
prion
prion
Code injection
2018-11-29 18:29:00
Remote code execution
2018-07-19 13:29:00
Code injection
2018-07-03 01:29:00
debiancve
debiancve
CVE-2018-16859
2018-11-29 18:29:00
CVE-2017-7481
2018-07-19 13:29:00
CVE-2017-7466
2018-06-22 13:29:00
attackerkb
attackerkb
CVE-2017-7481
2018-07-19 00:00:00
freebsd
freebsd
ansible -- Input validation flaw in jinja2 templating system
2017-05-09 00:00:00
mageia
mageia
Updated ansible packages fix security vulnerability
2018-07-01 20:17:14
Updated ansible package fixes security vulnerability
2019-01-09 00:50:23
Updated ansible package fixes security vulnerabilities
2018-11-12 00:09:54
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0152
2019-04-23 00:00:00
Critical Photon OS Security Update - PHSA-2019-0152
2019-04-23 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

0.025 Low

EPSS

Percentile

89.0%

JSON
Related for OPENSUSE-SU-2019:0238-1
openvas20fedora14nessus43redhat29debian3suse4osv20ubuntu1alpinelinux4veracode11redhatcve4ubuntucve5cve7github6prion6debiancve6attackerkb1freebsd1mageia4photon2