Bug 1439212 (CVE-2017-7466)
| Summary: | CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aortega, apevec, ayoung, bleanhar, bmcclain, btotty, carnil, ccoleman, chrisw, cvsbot-xmlrpc, dblechte, dedgar, dmcphers, eedri, elavarde, gmeno, jcammara, jgoulding, jjoyce, jkeck, jmckerr, joelsmith, jschluet, kbasil, kdreyer, kseifried, lhh, lpeer, markmc, mgoldboi, michal.skrivanek, rbobek, rbryant, rcyriac, rhos-maint, sbonazzo, sclewis, sdodson, security-response-team, sherold, sisharma, slinaber, smohan, ssaha, tdawson, tdecacqu, tvignaud, vbellur, ykaul, ylavi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible 2.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-07-25 21:09:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1441355, 1441356, 1441357, 1441358, 1441361, 1441362, 1441482, 1441485, 1447506, 1449764, 1449765, 1454993, 1454994 | ||
| Bug Blocks: | 1439215, 1453037, 1456591 | ||
|
Description
Adam Mariš
2017-04-05 12:40:57 UTC
Acknowledgments: Name: Evgeni Golov (Red Hat) notting [12:52 PM] jimi-c already pushed the fix to 2.2 git. i'd defer to @jmckerr & @thaumos on what we're going to officially release when and if it also needs thrown on 2.1. 2.3 isn't affected Created ansible1.9 tracking bugs for this issue: Affects: fedora-all [bug 1441356] Affects: epel-all [bug 1441358] Created ansible tracking bugs for this issue: Affects: fedora-all [bug 1441355] Affects: epel-all [bug 1441357] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.2 Red Hat OpenShift Container Platform 3.3 Red Hat OpenShift Container Platform 3.4 Red Hat OpenShift Container Platform 3.5 Via RHSA-2017:1244 https://access.redhat.com/errata/RHSA-2017:1244 This issue has been addressed in the following products: Red Hat Gluster Storage 3.2 for RHEL 7 Via RHSA-2017:1334 https://access.redhat.com/errata/RHSA-2017:1334 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.2 Red Hat OpenShift Container Platform 3.3 Red Hat OpenShift Container Platform 3.4 Red Hat OpenShift Container Platform 3.5 Via RHSA-2017:1244 https://access.redhat.com/errata/RHSA-2017:1244 This issue has been addressed in the following products: Red Hat OpenStack Platform 11.0 (Ocata) Via RHSA-2017:1476 https://access.redhat.com/errata/RHSA-2017:1476 This issue has been addressed in the following products: Red Hat Storage Console 2 for Red Hat Enteprise Linux 7 Via RHSA-2017:1499 https://access.redhat.com/errata/RHSA-2017:1499 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2017:1599 https://access.redhat.com/errata/RHSA-2017:1599 This issue has been addressed in the following products: RHEV Engine version 4.1 Via RHSA-2017:1685 https://access.redhat.com/errata/RHSA-2017:1685 |