A security flaw was found in the way Ansible, a SSH-based configuration management, deployment, and task execution system, performed remote server's SSH host key management (previously ability to store known SSH server's host keys to local cache was not supported). A remote attacker could use this flaw to conduct man-in-the-middle (MiTM) attacks against the Ansible task execution system user. References: [1] http://www.openwall.com/lists/oss-security/2013/07/01/2 [2] http://www.openwall.com/lists/oss-security/2013/07/02/6 Upstream bug (no upstream patch as of 2013-07-03): [3] https://github.com/ansible/ansible/issues/857
This issue affects the versions of the ansible package, as shipped with Fedora release of 17, 18, and 19. Please schedule an update (once there's final upstream patch available). -- This issue affects the version of the ansible package, as shipped with Fedora EPEL-6. Please schedule an update (once there's final upstream patch available).
Created ansible tracking bugs for this issue: Affects: fedora-all [bug 980827] Affects: epel-6 [bug 980828]
ansible-1.2.2-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
ansible-1.2.2-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
ansible-1.2.2-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
ansible-1.2.2-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.