Advisories » MGASA-2018-0303

Updated ansible packages fix security vulnerability

Publication date: 01 Jul 2018
Modification date: 01 Jul 2018
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2018-10855

Description

Ansible prior to 2.4.5 does not honor the no_log task flag for failed
tasks.  When the no_log flag has been used to protect sensitive data
passed to a task from being logged, and that task does not run
successfully, Ansible will expose sensitive data in log files and on the
terminal of the user running Ansible (CVE-2018-10855).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23225
• https://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ILGCAZWUN7RSPO3IEB46IIDRMCI3ALP3/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10855

SRPMS

6/core

• ansible-2.4.5.0-1.1.mga6

5/core

• ansible-2.4.5.0-1.1.mga5