FreshPorts - VuXML

Borja Tarraso reports:

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

< 2.8.9

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

RedHat security team reports:

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.

< 2.3.1

Ansible developers report:

CVE-2016-3096: do not use predictable paths in lxc_container

• do not use a predictable filename for the LXC attach script
• don't use predictable filenames for LXC attach script logging
• don't set a predictable archive_path

this should prevent symlink attacks which could result in

• data corruption
• data leakage
• privilege escalation

ge 2.0.0.0 lt 2.0.2.0

< 1.9.6

Ansible, Inc. reports:

Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4

< 1.6.4

ansible developers report:

Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.

le 2.2.3

Borja Tarraso reports:

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.

< 2.8.9

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

Ansible, Inc. reports:

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

< 1.9.2

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or untrusted local data - resolved in Ansible 1.6.7

< 1.6.7

Ansible changelog reports:

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

< 1.2.1

MITRE reports:

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.

< 1.2.3

Computest reports:

Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.

gt 1.9.6_1 lt 2.2.0.0_2

Borja Tarraso reports:

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

< 2.8.9

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

< 2.7.17

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7

ansible-galaxy command when used on local tarballs (and not galaxy.ansible.com) can install a malformed tarball if so provided - resolved in Ansible 1.7

< 1.7