ansible - security update

Fixed packages 1

Vulnerabilities 4

• High 7.3
  CVE-2019-14846

  Ansible Uses Plugins That Disclose Credentials

  In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. …

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Oct 8, 2019
• Medium 5.0
  CVE-2020-1733

  Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File

  A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp.…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Mar 11, 2020
• Low 3.9
  CVE-2020-1739

  Exposure of Sensitive Information to an Unauthorized Actor in Ansible

  A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advant…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Mar 12, 2020
• Low 3.9
  CVE-2020-1740

  Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

  A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Mar 16, 2020