[SECURITY] [DLA 3963-1] ansible security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3963-1 [email protected]
https://www.debian.org/lts/security/ Bastien Roucariès
November 23, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ansible
Version : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2
CVE ID : CVE-2024-8775 CVE-2024-9902
Debian Bug : 1082851
Ansible is a command-line IT automation software application.
It can configure systems, deploy software, and orchestrate
advanced workflows to support application deployment, system updates, ...
Ansible was affected by two vulnerabilities:
CVE-2024-8775
A flaw was found in Ansible, where sensitive information stored in
Ansible Vault files can be exposed in plaintext during the execution
of a playbook. This occurs when using tasks such as include_vars to
load vaulted variables without setting the no_log: true parameter,
resulting in sensitive data being printed in the playbook output or
logs. This can lead to the unintentional disclosure of secrets like
passwords or API keys, compromising security and potentially
allowing unauthorized access or actions.
CVE-2024-9902
The ansible-core `user` module can allow an unprivileged user to
silently create or replace the contents of any file on any system path
and take ownership of it when a privileged user executes
the `user` module against the unprivileged user's home directory.
If the unprivileged user has traversal permissions on the directory
containing the exploited target file, they retain full control
over the contents of the file as its owner.
For Debian 11 bullseye, these problems have been fixed in version
2.10.7+merged+base+2.10.17+dfsg-0+deb11u2.
We recommend that you upgrade your ansible packages.
For the detailed security status of ansible please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ansible
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmdDBB0ACgkQADoaLapB
CF/JRxAApN1SgMajc1eGHfj21TsgB5qgxmjCI9eK8t0KIN8nLszCqdrARs5U+oj/
rYY66oCiuLZmWQDeAJ6BK9R/45ZAHAnedieAcEVTVEpzA8fpfA94aW/Gv2GbpFxq
nxsusycutYLNjQEiZuZ6AOIee0H9LZ3rqpJEQyIL+RUZxffU6xoDVuLtBnEdYW4+
6OS3II4QtUE9aVHIzBXpCg87Mve6KtfcIBcVoNG5GXpzJDkhHQIeljc6ZnshDhdT
2h24Jp6pke/qXvgcd7pWwVnPTaQ8vz5QQxsLQpeN5K7nMl5FVzGsnM0hQGONGGSg
yDxNyEXWRzAWdIu72HBSNYP/avV62gVxmSi/IJGy+JiSmQU1qRDVGv33E8S1fp0B
SW9c0pwCcKSSqCWbyybLBVa2rGwHwbl/UKj0/i13DNnnkLO6rqyKjxraT8KjZMs8
Z/bfdiGD5mw0Sg3fNM1DK8uZMX3MMAC0aB2qGm+5B/51UJhhMejDl8mqr3URawUf
3Y2R8ZMEA3gaNboFJdlh0Q/Ik5Kj++z1DaEBDD1+HuBYEZMX3aaoBzbNq13xoCQt
AXw9KZysWyE7Cruj9VFTUTITa35wHgfX51q2vKSYSiSOFx7E+1i5vtF1PiJA4dSA
U79idfarY5ogKyhQTWJRFOA3nyep1mkahuR3i4nbEcyyy3AESx8=
=erOd
-----END PGP SIGNATURE-----
Reply to: