Bug 1717311 (CVE-2019-10156) - CVE-2019-10156 ansible: unsafe template evaluation of returned module data can lead to information disclosure
Summary: CVE-2019-10156 ansible: unsafe template evaluation of returned module data ca...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10156
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20190604,repor...
Depends On: 1719543 1719544 1719545 1722410 1722411 1717312 1717313 1717934 1717935 1718357 1718358
Blocks: 1717332
TreeView+ depends on / blocked
 
Reported: 2019-06-05 07:52 UTC by Marian Rehak
Modified: 2019-07-23 05:32 UTC (History)
47 users (show)

Fixed In Version: ansible-engine 2.6.18, ansible-engine 2.7.12, ansible-engine 2.8.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:07:15 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1705 None None None 2019-07-09 08:44:08 UTC
Red Hat Product Errata RHSA-2019:1706 None None None 2019-07-09 08:49:26 UTC
Red Hat Product Errata RHSA-2019:1707 None None None 2019-07-09 09:45:01 UTC
Red Hat Product Errata RHSA-2019:1708 None None None 2019-07-09 09:44:39 UTC

Description Marian Rehak 2019-06-05 07:52:44 UTC
[ansible_password] in the ~/.ssh/authorized_keys file is repalced by administrator's password on remote node by templating.

Upstream pull:

https://github.com/ansible/ansible/pull/57188

Comment 1 Marian Rehak 2019-06-05 07:53:02 UTC
Created ansible tracking bugs for this issue:

Affects: epel-all [bug 1717312]
Affects: fedora-all [bug 1717313]

Comment 2 Marian Rehak 2019-06-05 08:45:21 UTC
Acknowledgments:

Name: Ichiko Sakamoto (Solution Innovators)

Comment 6 Dave Baker 2019-06-06 19:33:18 UTC
Updated title

Comment 14 Hardik Vyas 2019-06-20 09:54:57 UTC
Gluster uses Ansible package from Ansible repository hence marked as WONTFIX and it will consume fixes from core Ansible.
Refer:
	https://url.corp.redhat.com/prerequisites
	https://url.corp.redhat.com/gdeploy-support-install-ansible

For Ceph we still maintain Ansible atleast for Ubuntu which uses Ansible package from Ceph repository.
Refer:
	https://url.corp.redhat.com/ubuntu
	https://url.corp.redhat.com/enabling-the-red-hat-ceph-storage-repositories
	https://url.corp.redhat.com/upgrading-a-red-hat-ceph-storage-cluster

Comment 16 errata-xmlrpc 2019-07-09 08:44:06 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.7 for RHEL 7

Via RHSA-2019:1705 https://access.redhat.com/errata/RHSA-2019:1705

Comment 17 errata-xmlrpc 2019-07-09 08:49:24 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2 for RHEL 8
  Red Hat Ansible Engine 2 for RHEL 7

Via RHSA-2019:1706 https://access.redhat.com/errata/RHSA-2019:1706

Comment 18 errata-xmlrpc 2019-07-09 09:44:37 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.8 for RHEL 8
  Red Hat Ansible Engine 2.8 for RHEL 7

Via RHSA-2019:1708 https://access.redhat.com/errata/RHSA-2019:1708

Comment 19 errata-xmlrpc 2019-07-09 09:44:59 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.6 for RHEL 7

Via RHSA-2019:1707 https://access.redhat.com/errata/RHSA-2019:1707

Comment 20 Product Security DevOps Team 2019-07-12 13:07:15 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10156


Note You need to log in before you can comment on or make changes to this bug.