Bug 1717311 (CVE-2019-10156)

Summary: CVE-2019-10156 ansible: unsafe template evaluation of returned module data can lead to information disclosure
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: a.badger, ahardin, amctagga, anharris, aos-bugs, athmanem, bleanhar, bniver, ccoleman, dajohnso, dbecker, dedgar, dmetzger, eparis, flucifre, gblomqui, gmainwar, gmccullo, gmeno, gtanzill, hvyas, jcammara, jfrey, jgoulding, jhardy, jjoyce, jlaska, jokerman, jschluet, jtanner, kbasil, kdixon, kevin, lhh, lpeer, maxim, mbenjamin, mburns, mchappel, mhackett, mmccomas, obarenbo, rhos-maint, roliveri, sclewis, simaishi, sisharma, slinaber, smunilla, ssaha, tkuratom, tvignaud, vbellur, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ansible-engine 2.6.18, ansible-engine 2.7.12, ansible-engine 2.8.2 Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:07:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1717312, 1717313, 1717934, 1717935, 1718357, 1718358, 1719543, 1719544, 1719545, 1722410, 1722411    
Bug Blocks: 1717332    

Description Marian Rehak 2019-06-05 07:52:44 UTC
[ansible_password] in the ~/.ssh/authorized_keys file is repalced by administrator's password on remote node by templating.

Upstream pull:

https://github.com/ansible/ansible/pull/57188

Comment 1 Marian Rehak 2019-06-05 07:53:02 UTC
Created ansible tracking bugs for this issue:

Affects: epel-all [bug 1717312]
Affects: fedora-all [bug 1717313]

Comment 2 Marian Rehak 2019-06-05 08:45:21 UTC
Acknowledgments:

Name: Ichiko Sakamoto (Solution Innovators)

Comment 6 Dave Baker 2019-06-06 19:33:18 UTC
Updated title

Comment 14 Hardik Vyas 2019-06-20 09:54:57 UTC
Gluster uses Ansible package from Ansible repository hence marked as WONTFIX and it will consume fixes from core Ansible.
Refer:
	https://url.corp.redhat.com/prerequisites
	https://url.corp.redhat.com/gdeploy-support-install-ansible

For Ceph we still maintain Ansible atleast for Ubuntu which uses Ansible package from Ceph repository.
Refer:
	https://url.corp.redhat.com/ubuntu
	https://url.corp.redhat.com/enabling-the-red-hat-ceph-storage-repositories
	https://url.corp.redhat.com/upgrading-a-red-hat-ceph-storage-cluster

Comment 16 errata-xmlrpc 2019-07-09 08:44:06 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.7 for RHEL 7

Via RHSA-2019:1705 https://access.redhat.com/errata/RHSA-2019:1705

Comment 17 errata-xmlrpc 2019-07-09 08:49:24 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2 for RHEL 8
  Red Hat Ansible Engine 2 for RHEL 7

Via RHSA-2019:1706 https://access.redhat.com/errata/RHSA-2019:1706

Comment 18 errata-xmlrpc 2019-07-09 09:44:37 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.8 for RHEL 8
  Red Hat Ansible Engine 2.8 for RHEL 7

Via RHSA-2019:1708 https://access.redhat.com/errata/RHSA-2019:1708

Comment 19 errata-xmlrpc 2019-07-09 09:44:59 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.6 for RHEL 7

Via RHSA-2019:1707 https://access.redhat.com/errata/RHSA-2019:1707

Comment 20 Product Security DevOps Team 2019-07-12 13:07:15 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10156

Comment 21 errata-xmlrpc 2019-11-06 15:26:36 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 14.0 (Rocky)

Via RHSA-2019:3744 https://access.redhat.com/errata/RHSA-2019:3744

Comment 22 errata-xmlrpc 2019-11-07 13:46:17 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)

Via RHSA-2019:3789 https://access.redhat.com/errata/RHSA-2019:3789