ansible - security update

Fixed packages 1

Vulnerabilities 4

• High 7.3
  CVE-2019-14846

  Ansible Uses Plugins That Disclose Credentials

  In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. …

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Oct 8, 2019
• High 7.3
  CVE-2019-14904

  OS Command Injection and Improper Input Validation in ansible

  A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…

  ansible ansible ansible ansible Debian Ubuntu Alpine PyPI
  Aug 25, 2020
• Medium 5.3
  CVE-2017-7481

  Ansible fails to properly mark lookup-plugin results as unsafe

  Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code e…

  [UNKNOWN] ansible ansible ansible Debian Ubuntu PyPI
  Jul 19, 2018
• Medium 4.6
  CVE-2019-10156

  Exposure of Sensitive Information to an Unauthorized Actor in ansible

  A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitutio…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Jul 30, 2019