Bug 1717311 (CVE-2019-10156)
Summary: | CVE-2019-10156 ansible: unsafe template evaluation of returned module data can lead to information disclosure | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | a.badger, ahardin, amctagga, anharris, aos-bugs, athmanem, bleanhar, bniver, ccoleman, dajohnso, dbecker, dedgar, dmetzger, eparis, flucifre, gblomqui, gmainwar, gmccullo, gmeno, gtanzill, hvyas, jcammara, jfrey, jgoulding, jhardy, jjoyce, jlaska, jokerman, jschluet, jtanner, kbasil, kdixon, kevin, lhh, lpeer, maxim, mbenjamin, mburns, mchappel, mhackett, mmccomas, obarenbo, rhos-maint, roliveri, sclewis, simaishi, sisharma, slinaber, smunilla, ssaha, tkuratom, tvignaud, vbellur, vereddy |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | ansible-engine 2.6.18, ansible-engine 2.7.12, ansible-engine 2.8.2 | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-07-12 13:07:15 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1717312, 1717313, 1717934, 1717935, 1718357, 1718358, 1719543, 1719544, 1719545, 1722410, 1722411 | ||
Bug Blocks: | 1717332 |
Description
Marian Rehak
2019-06-05 07:52:44 UTC
Created ansible tracking bugs for this issue: Affects: epel-all [bug 1717312] Affects: fedora-all [bug 1717313] Acknowledgments: Name: Ichiko Sakamoto (Solution Innovators) Updated title Gluster uses Ansible package from Ansible repository hence marked as WONTFIX and it will consume fixes from core Ansible. Refer: https://url.corp.redhat.com/prerequisites https://url.corp.redhat.com/gdeploy-support-install-ansible For Ceph we still maintain Ansible atleast for Ubuntu which uses Ansible package from Ceph repository. Refer: https://url.corp.redhat.com/ubuntu https://url.corp.redhat.com/enabling-the-red-hat-ceph-storage-repositories https://url.corp.redhat.com/upgrading-a-red-hat-ceph-storage-cluster This issue has been addressed in the following products: Red Hat Ansible Engine 2.7 for RHEL 7 Via RHSA-2019:1705 https://access.redhat.com/errata/RHSA-2019:1705 This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 8 Red Hat Ansible Engine 2 for RHEL 7 Via RHSA-2019:1706 https://access.redhat.com/errata/RHSA-2019:1706 This issue has been addressed in the following products: Red Hat Ansible Engine 2.8 for RHEL 8 Red Hat Ansible Engine 2.8 for RHEL 7 Via RHSA-2019:1708 https://access.redhat.com/errata/RHSA-2019:1708 This issue has been addressed in the following products: Red Hat Ansible Engine 2.6 for RHEL 7 Via RHSA-2019:1707 https://access.redhat.com/errata/RHSA-2019:1707 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10156 This issue has been addressed in the following products: Red Hat OpenStack Platform 14.0 (Rocky) Via RHSA-2019:3744 https://access.redhat.com/errata/RHSA-2019:3744 This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Via RHSA-2019:3789 https://access.redhat.com/errata/RHSA-2019:3789 |