Thank you for this notification.
Assigning to Bruno for 'ansible'; CC DavidW for security.

CC: (none) => luigiwalser
QA Contact: (none) => security
Assignee: bugsquad => bruno
Source RPM: ansible => ansible-2.7.12-1.mga7.src.rpm
Component: RPM Packages => Security

Zombie, please provide a link to the advisory and don't copy and paste the text.

Lewis, I am the security group, so I already get the e-mails.  You don't need to CC me.

Advisory link from October 24:
https://access.redhat.com/errata/RHSA-2019:3203

It appears that all of the issues are fixed upstream in 2.7.14 and 2.8.6.

Version: 7 => Cauldron
Whiteboard: (none) => MGA7TOO
Summary: ansible Security update (CVE-2019-10206 (CVE-2019-14856) => ansible new security issues CVE-2019-10206, CVE-2019-14846, and CVE-2019-14858

2.8.6 updated and pushed to cauldron

Status: NEW => ASSIGNED

2.7.14 built for mga6 but I'm unable to push it:
- ansible-2.7.14-1.mga6.src:
 - FREEZE: repository 6 section core/updates_testing is frozen, you can still submit your packages in testing

Can someoneelse do it, or should I use another repo ?

Pushed for mga7 to update_testing

Assignee: bruno => qa-bugs

Thanks Bruno.  Please remember to leave yourself in CC when assigning to QA.  Mageia 6 is EOL.

Whiteboard: MGA7TOO => (none)
CC: (none) => bruno
Version: Cauldron => 7

Advisory:
========================

Updated ansible package fixes security vulnerabilities:

ansible-playbook -k and ansible cli tools prompt passwords by expanding them
from templates as they could contain special characters. Passwords should be
wrapped to prevent templates trigger and exposing them (CVE-2019-10206).

Ansible was logging at the DEBUG level which lead to a disclosure of
credentials if a plugin used a library that logged credentials at the DEBUG
level. This flaw does not affect Ansible modules, as those are executed in a
separate process (CVE-2019-14846).

When a module has an argument_spec with sub parameters marked as no_log,
passing an invalid parameter name to the module will cause the task to fail
before the no_log options in the sub parameters are processed. As a result,
data in the sub parameter fields will not be masked and will be displayed if
Ansible is run with increased verbosity and present in the module invocation
arguments for the task (CVE-2019-14858).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10206
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14846
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14858
https://access.redhat.com/errata/RHSA-2019:3203
========================

Updated packages in core/updates_testing:
========================
ansible-2.7.14-1.mga7

from ansible-2.7.14-1.mga7.src.rpm

Mageia7, x86_64

$ rpm -qa | grep ansible
ansible-2.7.12-1.mga7
Updated from updates-testing.
$ rpm -qa | grep ansible                                     
ansible-2.7.14-1.mga7

Created a /tmp/hosts file containing IP addresses of local network hosts, some  inaccessible because the machines wereswitched off.

$ ansible -i /tmp/hosts all -m ping
[...]
192.168.1.bb | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
192.168.1.ddd | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.1.ddd port 22: No route to host",
    "unreachable": true
}
192.168.1.ee | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.1.ee port 22: No route to host",
    "unreachable": true
}

The elided section contains the same localhost message as in the following example.  Does not seem to like localhost.  Remote hosts are OK.

$ ansible -i /etc/ansible/hosts all -a "echo hello"
192.168.1.aaa | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nIT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\r\nSomeone could be eavesdropping on you right now (man-in-the-middle attack)!\r\nIt is also possible that a host key has just been changed.\r\nThe fingerprint for the ECDSA key sent by the remote host is\nSHA256:..............................\r\nPlease contact your system administrator.\r\nAdd correct host key in /home/lcl/.ssh/known_hosts to get rid of this message.\r\nOffending ECDSA key in /home/lcl/.ssh/known_hosts:25\r\nChallenge/response authentication is disabled to avoid man-in-the-middle attacks.\r\nAgent forwarding is disabled to avoid man-in-the-middle attacks.\r\nX11 forwarding is disabled to avoid man-in-the-middle attacks.\r\nlcl@192.168.1.103: Permission denied (publickey,password,keyboard-interactive).",
    "unreachable": true
}
192.168.1.bb | CHANGED | rc=0 >>
hello

Reduced /tmp/hosts to just one host.

$ ansible -i /tmp/hosts all -a "stellarium"
192.168.1.bb | FAILED | rc=-11 >>
 -----------------------------------------------------
[ This is Stellarium 0.19.0 - https://stellarium.org/ ]
[ Copyright (C) 2000-2019 Fabien Chereau et al.       ]
 -----------------------------------------------------
Writing log file to: "/home/lcl/.stellarium/log.txt"

The stellarium logo appeared on localhost monitor so it was a partial success.

$ ansible -i /tmp/hosts all -a "/home/lcl/bin/weatherview"

That works perfectly - brings up a ruby-tk gui which respondes to mouse and keyboard events on the local machine.  Ran the same application directly on localhost.  The two guis are shown at different sizes to reflect that the applications have been scaled to suit the two different monitors.  The remote machine has 2560x1440 and this one is 4K.

These simple tests are as far as ansible can be taken here without more training.  Good for 64-bits.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => tarazed25

Thank you, Len. Validating. Advisory in Comment 8.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0309.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED