| Summary: | ansible new security issue CVE-2021-3620 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, bruno.cornec, bruno, davidwhodgins, herman.viaene, mageia, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | ansible-2.9.23-1.mga8.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2021-10-15 20:30:42 CEST
David Walser
2021-10-15 20:31:04 CEST
Status comment:
(none) =>
Fixed upstream in 2.9.27 New version in mageia 8:
src:
- ansible-2.9.27-1.mga8Assignee:
bugsquad =>
qa-bugs MGA8-64 Plasma on Lenovo B50 No installation issues The commands as shown in bug 28832 do not work anymore, I get: $ ansible i ~/tmp/hosts all -m ping usage: ansible [-h] [--version] [-v] [-b] [--become-method BECOME_METHOD] [--become-user BECOME_USER] [-K] [-i INVENTORY] [--list-hosts] [-l SUBSET] [-P POLL_INTERVAL] [-B SECONDS] [-o] [-t TREE] [-k] [--private-key PRIVATE_KEY_FILE] [-u REMOTE_USER] [-c CONNECTION] [-T TIMEOUT] [--ssh-common-args SSH_COMMON_ARGS] [--sftp-extra-args SFTP_EXTRA_ARGS] [--scp-extra-args SCP_EXTRA_ARGS] [--ssh-extra-args SSH_EXTRA_ARGS] [-C] [--syntax-check] [-D] [-e EXTRA_VARS] [--vault-id VAULT_IDS] [--ask-vault-pass | --vault-password-file VAULT_PASSWORD_FILES] [-f FORKS] [-M MODULE_PATH] [--playbook-dir BASEDIR] [-a MODULE_ARGS] [-m MODULE_NAME] pattern ansible: error: unrecognized arguments: /home/tester8/tmp/hosts all Reading https://www.digitalocean.com/community/cheatsheets/how-to-use-ansible-cheat-sheet-guide I fill in two FQDN's from my LAN, and althuogh I can successfully login with the ssh command,I get $ ansible all -u herman -m ping --ask-pass SSH password: <entered password> mach1.hviaene.thuis | FAILED! => { "msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host." } mach5.hviaene.thuis | UNREACHABLE! => { "changed": false, "msg": "Invalid/incorrect password: ", "unreachable": true } That's all beyond me. CC:
(none) =>
herman.viaene Trouble with this here also, before the update.
$ rpm -q ansible
ansible-2.9.24-1.mga8
$ ansible -m ping -i ~/tmp/hosts all
192.168.1.aaa | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: lcl@192.168.1.aaa: Permission denied (publickey,password,keyboard-interactive).",
"unreachable": true
}
192.168.1.bbb | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: lcl@192.168.1.bbb: Permission denied (publickey,password,keyboard-interactive).",
"unreachable": true
}
The last time this was tried those nodes worked with ansible. Commandline pings work and so do ssh logins. The trouble in ansible definitely points to SSH authentication. It works for the user but not for ansible. Compared fingerprints on the remote machine with the local machine but found there were four for the home machine, different fingerprints for a.b.c.d, localhost, named node and named.local. Too confusing to check which was which.
As a last resort I copied the local ids to the target machine and that seemed to do the trick.
$ ssh-copy-id <user@remote>
$ ansible -m ping all -i ~/tmp/hosts
Enter passphrase for key '/home/lcl/.ssh/id_rsa': 192.168.1.bbb | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: lcl@192.168.1.bbb: Permission denied (publickey,password,keyboard-interactive).",
"unreachable": true
}
[WARNING]: Platform linux on host 192.168.1.aaa is using the discovered Python
interpreter at /usr/bin/python, but future installation of another Python
interpreter could change this. See https://docs.ansible.com/ansible/2.9/referen
ce_appendices/interpreter_discovery.html for more information.
192.168.1.aaa | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
I shall carry on in this vein and report back.CC:
(none) =>
tarazed25 Updated the ids on both remote machines and checked ansible with the ping command. On first use each host requires the passphrase for the public key. Working fine. Updated for x86_64 and ran the simple check again. $ ansible -m ping all -i ~/tmp/hosts [WARNING]: Platform linux on host 192.168.1.aaa is using the discovered Python interpreter at /usr/bin/python, but future installation of another Python interpreter could change this. See https://docs.ansible.com/ansible/2.9/referen ce_appendices/interpreter_discovery.html for more information. 192.168.1.aaa | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [WARNING]: Platform linux on host 192.168.1.bbb is using the discovered Python interpreter at /usr/bin/python, but future installation of another Python interpreter could change this. See https://docs.ansible.com/ansible/2.9/referen ce_appendices/interpreter_discovery.html for more information. 192.168.1.bbb | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } This is a very basic test for ansible and it has always been accepted in the past so it gets the OK. Thanks Herman. Whiteboard:
(none) =>
MGA8-64-OK Validating. Keywords:
(none) =>
validated_update
Dave Hodgins
2021-10-23 03:23:16 CEST
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0487.html Status:
NEW =>
RESOLVED |