Bug 13278 - ansible new security issues fixed upstream in 1.5.5 (CVE-2014-465[789], CVE-2014-4660)
Summary: ansible new security issues fixed upstream in 1.5.5 (CVE-2014-465[789], CVE-2...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/596583/
Whiteboard: has_procedure advisory mga4-32-ok MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-04-28 19:11 CEST by David Walser
Modified: 2014-06-26 21:05 CEST (History)
4 users (show)

See Also:
Source RPM: ansible-1.4.3-1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2014-04-28 19:11:57 CEST
Upstream's changelog from April 18 shows security issues fixed in 1.5.4 and 1.5.5:
https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md

Fedora has issued an advisory on April 20:
https://lists.fedoraproject.org/pipermail/package-announce/2014-April/132215.html

There aren't any details, so it's not entirely clear if 1.4.x is affected, but if so, Mageia 4 would also be affected.

Reproducible: 

Steps to Reproduce:
David Walser 2014-04-28 19:12:04 CEST

Whiteboard: (none) => MGA4TOO

Comment 1 Bruno Cornec 2014-04-29 01:08:43 CEST
I have uploaded into cooker ansible 1.5.5
David Walser 2014-04-29 02:44:17 CEST

Version: Cauldron => 4
Whiteboard: MGA4TOO => (none)

Comment 2 Philippe Makowski 2014-06-03 23:53:37 CEST
just in case, seems that it is this patch for "Security fix for safe_eval" :
https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c

and for Security fix for vault :
https://github.com/ansible/ansible/commit/a0e027fe362fbc209dbeff2f72d6e95f39885c69

and for apt :
https://github.com/ansible/ansible/commit/c4b5e46054c74176b2446c82d4df1a2610eddc08

CC: (none) => makowski.mageia

Comment 3 David Walser 2014-06-04 21:22:12 CEST
Thanks Philippe, that was helpful.

The vault code is not present in 1.4.3, so that's not relevant here.

The other two parts are present.  The safe_eval patch applies cleanly, and the apt_repository patch applies with minimal modifications.  I don't know if we actually need the apt_repository patch since we don't use apt, but I'm not sure exactly how this software is used.  I've added both patches.

Advisory:
========================

Ansible has been patched with minor security fixes to safe_eval and
apt_repository that were fixed upstream in version 1.5.5.

References:
https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
https://lists.fedoraproject.org/pipermail/package-announce/2014-April/132215.html
========================

Updated packages in core/updates_testing:
========================
ansible-1.4.3-1.1.mga4

from ansible-1.4.3-1.1.mga4.src.rpm

CC: (none) => bruno
Assignee: bruno => qa-bugs

Comment 4 Philippe Makowski 2014-06-17 19:29:34 CEST
tested ok under Mga4 64 (generic test only)

only a simple test with a distant box where you have ssh access and your ssh-key setup in :

create a file, for example /tmp/hosts with the ip address if the distant box:

$ cat /tmp/hosts 
192.168.0.51
$ ansible -i /tmp/hosts all -m ping
192.168.0.51 | success >> {
    "changed": false, 
    "ping": "pong"
}

$

Whiteboard: (none) => has_procedure MGA4-64-OK

Comment 5 claire robinson 2014-06-20 12:42:18 CEST
Testing complete mga4 32

Thanks for the procedure Philippe

Whiteboard: has_procedure MGA4-64-OK => has_procedure mga4-32-ok MGA4-64-OK

Comment 6 claire robinson 2014-06-20 18:28:37 CEST
Validating. Advisory uploaded.

Could sysadmin please push to 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: has_procedure mga4-32-ok MGA4-64-OK => has_procedure advisory mga4-32-ok MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 7 Thomas Backlund 2014-06-20 21:51:59 CEST
Update pushed:
http://advisories.mageia.org/MGASA-2014-0269.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

Comment 8 David Walser 2014-06-23 21:51:04 CEST
FYI, Michael Scherer requested CVEs for this:
http://openwall.com/lists/oss-security/2014/06/23/10
Comment 9 David Walser 2014-06-26 21:05:37 CEST
The safe_eval issue was assigned CVE-2014-4657.

The apt_repository issues were assigned CVE-2014-4659 and CVE-2014-4660.

CVE-2014-4658 was assigned for the vault issue only in 1.5.x.

Details are here:
http://openwall.com/lists/oss-security/2014/06/26/19

Updated advisory below.

Advisory:
========================

Ansible has been patched with minor security fixes to safe_eval (CVE-2014-4657)
and apt_repository (CVE-2014-4659, CVE-2014-4660) that were fixed upstream in
version 1.5.5.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4657
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4660
https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
https://lists.fedoraproject.org/pipermail/package-announce/2014-April/132215.html

Summary: ansible new security issues fixed upstream in 1.5.5 => ansible new security issues fixed upstream in 1.5.5 (CVE-2014-465[789], CVE-2014-4660)


Note You need to log in before you can comment on or make changes to this bug.