Bug 33828 - python-ansible-core new security issues CVE-2024-8775, CVE-2024-9902 and CVE-2024-11079
Summary: python-ansible-core new security issues CVE-2024-8775, CVE-2024-9902 and CVE-...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-12-04 15:52 CET by Nicolas Salguero
Modified: 2025-02-12 07:38 CET (History)
2 users (show)

See Also:
Source RPM: python-ansible-core-2.14.17-1.1.mga9.src.rpm
CVE: CVE-2024-8775, CVE-2024-9902, CVE-2024-11079
Status comment:


Attachments

Description Nicolas Salguero 2024-12-04 15:52:13 CET
openSUSE has issued an advisory on December 3:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2Y6RFLPB54N7XR7AP7A2DEXGLBEDEQJU/
Nicolas Salguero 2024-12-04 15:56:59 CET

Source RPM: (none) => python-ansible-core-2.17.3-1.mga10.src.rpm, python-ansible-core-2.14.17-1.1.mga9.src.rpm
Summary: python-ansible-core new security issues CVE-2024-8775 and CVE-2024-9902 => python-ansible-core new security issues CVE-2024-8775, CVE-2024-9902 and CVE-2024-11079
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2024-8775, CVE-2024-9902, CVE-2024-11079
Status comment: (none) => Fixed upstream in 2.17.7 and 2.14.18 (only CVE-2024-8775)

Comment 1 Lewis Smith 2024-12-04 20:13:52 CET
M9 currently at python3-ansible-core Version     : 2.14.17
Cauldron: version 2.17.3

Assigning to Python maintainers.

Assignee: bugsquad => python

Comment 2 Nicolas Salguero 2025-02-10 14:47:59 CET
Fixed in Cauldron.

Source RPM: python-ansible-core-2.17.3-1.mga10.src.rpm, python-ansible-core-2.14.17-1.1.mga9.src.rpm => python-ansible-core-2.14.17-1.1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

Comment 3 Nicolas Salguero 2025-02-10 15:16:44 CET
Suggested advisory:
========================

The updated package fixes security vulnerabilities:

Exposure of sensitive information in ansible vault files due to improper logging. (CVE-2024-8775)

Ansible-core user may read/write unauthorized content. (CVE-2024-9902)

Unsafe tagging bypass via hostvars object in ansible-core. (CVE-2024-11079)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2Y6RFLPB54N7XR7AP7A2DEXGLBEDEQJU/
========================

Updated package in core/updates_testing:
========================
python3-ansible-core-2.14.18-1.mga9

from SRPM:
python-ansible-core-2.14.18-1.mga9.src.rpm

Status: NEW => ASSIGNED
Assignee: python => qa-bugs
Status comment: Fixed upstream in 2.17.7 and 2.14.18 (only CVE-2024-8775) => (none)

katnatek 2025-02-10 20:05:57 CET

Keywords: (none) => advisory

Comment 4 katnatek 2025-02-10 21:05:23 CET
RH x86_64

installing python3-ansible-core-2.14.18-1.mga9.noarch.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: python3-ansible-core  ##################################################################################################
      1/1: removing python3-ansible-core-2.14.17-1.1.mga9.noarch
                                 ##################################################################################################
writing /var/lib/rpm/installed-through-deps.list

ansible-lint depend on this so I test if still works as in bug#32419 comment#25


ansible-lint check_backend.yml 
WARNING  Listing 1 violation(s) that are fatal
load-failure[runtimeerror]: Failed to load YAML file
check_backend.yml:1 while parsing a quoted scalar
  in "<unicode string>", line 156, column 15
found unknown escape character
  in "<unicode string>", line 156, column 73


                    Rule Violation Summary                     
 count tag                        profile rule associated tags 
     1 load-failure[runtimeerror] min     core, unskippable    

Failed: 1 failure(s), 0 warning(s) on 1 files.
A new release of ansible-lint is available: 6.21.1 → 25.1.2

Looks consistent with the expected output

CC: (none) => andrewsfarm
Whiteboard: (none) => MGA9-64-OK

Comment 5 Thomas Andrews 2025-02-11 16:35:29 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2025-02-12 07:38:36 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0052.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.