ansible - security update

Fixed packages 1

Vulnerabilities 4

• High 7.8
  CVE-2015-6240

  Ansible Sandbox Escape via Symlink Attack

  The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.

  ansible ansible ansible Debian Ubuntu PyPI
  Jun 7, 2017
• High 7.8
  CVE-2018-10875

  Ansible Arbitrary Code Execution

  A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

  [UNKNOWN] ansible ansible ansible Debian Ubuntu Alpine PyPI
  Jul 13, 2018
• High 7.5
  CVE-2015-3908

  Ansible does not verify that the server hostname matches a domain name in certificates

  Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certif…

  ansible ansible ansible Debian Ubuntu PyPI
  Aug 12, 2015
• Medium 4.6
  CVE-2019-10156

  Exposure of Sensitive Information to an Unauthorized Actor in ansible

  A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Jul 30, 2019