Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.3948 Ansible security update 25 October 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Ansible Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 7 Red Hat Enterprise Linux WS/Desktop 7 Red Hat Enterprise Linux Server 8 Red Hat Enterprise Linux WS/Desktop 8 UNIX variants (UNIX, Linux, OSX) Impact/Access: Access Privileged Data -- Remote with User Interaction Modify Arbitrary Files -- Remote with User Interaction Denial of Service -- Existing Account Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2019-14858 CVE-2019-14856 CVE-2019-14846 CVE-2019-10206 Reference: ESB-2019.3347 ESB-2019.3188 Original Bulletin: https://access.redhat.com/errata/RHSA-2019:3201 https://access.redhat.com/errata/RHSA-2019:3202 https://access.redhat.com/errata/RHSA-2019:3203 https://access.redhat.com/errata/RHSA-2019:3207 Comment: This bulletin contains four (4) Red Hat security advisories. This advisory references vulnerabilities in products which run on platforms other than Red Hat. It is recommended that administrators running Ansible check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Ansible security update Advisory ID: RHSA-2019:3201-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2019:3201 Issue date: 2019-10-24 CVE Names: CVE-2019-14846 CVE-2019-14856 CVE-2019-14858=20 ===================================================================== 1. Summary: An update is now available for Ansible Engine 2.6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Engine 2.6 for RHEL 7 Server - noarch 3. Description: Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.6.20) Bug Fix(es): * ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856) * ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858) * ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846) See: https://github.com/ansible/ansible/blob/v2.6.20/changelogs/CHANGELOG-v2.6.r st for details on bug fixes in this release. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1755373 - CVE-2019-14846 ansible: secrets disclosed on logs when no_log ena= bled 1760593 - CVE-2019-14858 ansible: sub parameters marked as no_log are not m= asked in certain failure scenarios 1760829 - CVE-2019-14856 ansible: Incomplete fix for CVE-2019-10206 6. Package List: Red Hat Ansible Engine 2.6 for RHEL 7 Server: Source: ansible-2.6.20-1.el7ae.src.rpm noarch: ansible-2.6.20-1.el7ae.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14846 https://access.redhat.com/security/cve/CVE-2019-14856 https://access.redhat.com/security/cve/CVE-2019-14858 https://access.redhat.com/security/updates/classification/#important https://github.com/ansible/ansible/blob/v2.6.20/changelogs/CHANGELOG-v2.6.r= st 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXbGgz9zjgjWX9erEAQiu8A/8Cmgt32XsVnDvg0UIrS/3uUDuqlwpP5/l 7kDbhH4YvmGhZdDlHrDyuiVCtZZQTc5zEn3ggAlgqvPUx1shA2jNTOpOIBkBh4KZ Bgk6kOVipDR3h2YY19Bf8tWpxmGk9AsAb5zlUZ8XAf1AtFAUe2xS+o1vTj4tfW6i Q8FWm11tKg3ieObj7LNfJdcueGMCnjZce5MOd9CpnxMAzwWt2Tytb8XuPGfDpWBp sn6Dz0ERXA+eR9aJBGk7WFS6QEeRXUXHjFWLIo8iYxbmXGSMdfOA1A5lNh7OYorP p4VuPIYI6h+RIB1EAxt+GU9b4AWsxhlqKpEOCJn+kqqsTOC+Uv0eFui1E/shLTB4 zWo9yE75RhdrEAgBsjFs5DPQNWWHg1mYIeXGsjX1JfOPGIjfeIv/5LYlUrOJUzgB 3N8k+7h+xJM79DTfZEigAzCqEOLmk9JqPFY9aKVHNS2iQuI5hRPmiyDMpmDWSGlV n5Pm7DhmU91ixtqYXPLT/lkgCaZE5+Bu3i/lo/GhONw+UylWTNF4Ql4fEQXso3g/ RqP6VEDSUoTHkBn9YelFYpmSZ3Ug5c+/pH/3jGLMIfcEI0MIkvJ8JocBr4yvEKRi jg3cVktxnEux4IM1XWr9YGLHdyDemlwJ7bzTlVlpJaot+wGuPun7REMMfXlm3p7O IKZ3+hMhIQ0=3D =3D6q1d - -----END PGP SIGNATURE----- ============================================================================== - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Ansible security and bug fix update Advisory ID: RHSA-2019:3202-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2019:3202 Issue date: 2019-10-24 CVE Names: CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 ===================================================================== 1. Summary: An update is now available for Ansible Engine 2.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Engine 2.7 for RHEL 7 Server - noarch 3. Description: Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.7.14) Bug Fix(es): * ansible: Incomplete fix for CVE-2019-10206 (CVE-2019-14856) * ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858) * ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846) See: https://github.com/ansible/ansible/blob/v2.7.14/changelogs/CHANGELOG-v2.7.r st for details on bug fixes in this release. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1755373 - CVE-2019-14846 ansible: secrets disclosed on logs when no_log enabled 1760593 - CVE-2019-14858 ansible: sub parameters marked as no_log are not masked in certain failure scenarios 1760829 - CVE-2019-14856 ansible: Incomplete fix for CVE-2019-10206 6. Package List: Red Hat Ansible Engine 2.7 for RHEL 7 Server: Source: ansible-2.7.14-1.el7ae.src.rpm noarch: ansible-2.7.14-1.el7ae.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14846 https://access.redhat.com/security/cve/CVE-2019-14856 https://access.redhat.com/security/cve/CVE-2019-14858 https://access.redhat.com/security/updates/classification/#important https://github.com/ansible/ansible/blob/v2.7.14/changelogs/CHANGELOG-v2.7.rst 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXbGg2dzjgjWX9erEAQh6uQ//Zefnv6mrL6qzQSb9/3EYXmWtXUlgvBGm IiBCYDOZhQgXVyhElOxfMzrsbIO4oH0zh0gI/udLK1bZSXiO4T2eMrhuwPBjMkUg K4eBEnvmGSSGiQMnSNUurTOv9AMziv/bHMkACVd2u06JLoQnUp2FnjZcIofQRiPN r1/dUpD3Sv3GfGBkRY3XI0HbI8sZ7dFZK2VLdoFSecH4gF8W/LuXPtJEvDV/LIPd F5VfRtoFfuYrMa6NT5kAuI4nClSZivw/s9bNQZcNHIh3hh5PRihDbTzsehU0Qwxl YoQPMOOdzWlg6v/qno7MFiUb9mfxBF7XgI2qusCwAxHtOT5GcqJ8jQ4WwwdW2I5P mgedYCxuOwvWUs1FBr2/7qN7O+ZGdMDCxiDvdu26Oek1d7zenYZ1j1CClIfYta5y O8GXuXwSWe5dWdZ/em+WOQn7Zw6HaMBNOc5YG+jFJ0Ulw4vN6tEPgOQx3CrayLvL o1/ygw+88ENTfF3uL6TcWyYfBMEI1T5YIlvD0uKzaJcjA+HNXYZgPz2OB5FSMUG2 m0Qk+fpMhDsBTCPwbsqETQBrXN4hzvTnOiDSFAWsSk6E1a9eAWyivKrD21pRvYdw YvvTm5bKyGjR1Spyp2kYAB3FHrzRoMg6sOjhKF52ROsJxEBTpDBQqxf5UYdV//Qa +8JVEGR7+pg= =6Ghu - -----END PGP SIGNATURE----- ============================================================================== - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Ansible security and bug fix update Advisory ID: RHSA-2019:3203-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2019:3203 Issue date: 2019-10-24 CVE Names: CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 ===================================================================== 1. Summary: An update is now available for Ansible Engine 2.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Engine 2.8 for RHEL 7 Server - noarch Red Hat Ansible Engine 2.8 for RHEL 8 - noarch 3. Description: Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.8.6) Bug Fix(es): * ansible: incomplete fix for CVE-2019-10206 (CVE-2019-14856) * ansible: sub parameters marked as no_log are not masked in certain failure scenarios (CVE-2019-14858) * ansible: secrets disclosed on logs when no_log enabled (CVE-2019-14846) See: https://github.com/ansible/ansible/blob/v2.8.6/changelogs/CHANGELOG-v2.8.rs t for details on bug fixes in this release. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1755373 - CVE-2019-14846 ansible: secrets disclosed on logs when no_log enabled 1760593 - CVE-2019-14858 ansible: sub parameters marked as no_log are not masked in certain failure scenarios 1760829 - CVE-2019-14856 ansible: Incomplete fix for CVE-2019-10206 6. Package List: Red Hat Ansible Engine 2.8 for RHEL 7 Server: Source: ansible-2.8.6-1.el7ae.src.rpm noarch: ansible-2.8.6-1.el7ae.noarch.rpm Red Hat Ansible Engine 2.8 for RHEL 8: Source: ansible-2.8.6-1.el8ae.src.rpm noarch: ansible-2.8.6-1.el8ae.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14846 https://access.redhat.com/security/cve/CVE-2019-14856 https://access.redhat.com/security/cve/CVE-2019-14858 https://access.redhat.com/security/updates/classification/#important https://github.com/ansible/ansible/blob/v2.8.6/changelogs/CHANGELOG-v2.8.rst 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXbGh+tzjgjWX9erEAQjZKA//acV1loN8Pz6ycRec8p5Iz3mm8kQES7cv zXb/uiiHkUsPwsNO6gBl8/RmbkJNM2I0+UH+dBD6bfE/SwdqnebjTs8qzRv/WCSH aeFZs3pC5sDw5lCiH+VnpqIPtnItL5fHi/doBgaPzU8zxc/uWDMuaOKfU/5tMFGK poPWmbaH1Oq0f4n7dWwl9Z8nvowFS32d0damsQKLLGYD9DzYNs2UvJ7OD89EN/hf 3gBLg5LIegZB3EMKgXpZ8yfqhZw2QIY0B1EoF2SidC0ibgdQethyDeKSfAG1QrRd PxK1/PsyyOqYq4/yAXaqmdHVAcMy7pVtqEIyDVCiu9L91yg2hKpkzXJcZBN58T7Z fZwK2pHb4B1sP+lHFoBMvwxT7sBWlMOcbKM/EwHn/0cbrQHrNOG5F1WjjG1F2XNm FJzdhqL/YRSeTKdrvhQWjfsDjAX0siZTKGqb9vJl4XqQGD7fkUCBleEdM5ibLrBS e2oTqMRJZb8OgpcM97xJlB6Q/w81pKNhHVDGN5183nBfPqeBwhdlALSVCeLqTeal Vjt1IA9Sq6Uu8zmofaNNF+0SjXydUD9/eaexDA4ZnchOZm59ZbtCGk7WGIlpGANB nmt35uZpHQALv0dBZtRaj2h7UCWAUyp2ULRcx+jODauK5GzpitEIUQ9IbURTmx7t AuIu66YTGk0= =iZiv - -----END PGP SIGNATURE----- ============================================================================== - ----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Ansible security and bug fix update Advisory ID: RHSA-2019:3207-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2019:3207 Issue date: 2019-10-24 CVE Names: CVE-2019-14846 CVE-2019-14856 CVE-2019-14858 ===================================================================== 1. Summary: An update is now available for Ansible Engine 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Engine 2 for RHEL 7 - noarch Red Hat Ansible Engine 2 for RHEL 8 - noarch 3. Description: Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.8.6) Bug Fix(es): See: https://github.com/ansible/ansible/blob/v2.8.6/changelogs/CHANGELOG-v2.8.rs t for details on bug fixes in this release. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1755373 - CVE-2019-14846 ansible: secrets disclosed on logs when no_log enabled 1760593 - CVE-2019-14858 ansible: sub parameters marked as no_log are not masked in certain failure scenarios 1760829 - CVE-2019-14856 ansible: Incomplete fix for CVE-2019-10206 6. Package List: Red Hat Ansible Engine 2 for RHEL 7: Source: ansible-2.8.6-1.el7ae.src.rpm noarch: ansible-2.8.6-1.el7ae.noarch.rpm Red Hat Ansible Engine 2 for RHEL 8: Source: ansible-2.8.6-1.el8ae.src.rpm noarch: ansible-2.8.6-1.el8ae.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-14846 https://access.redhat.com/security/cve/CVE-2019-14856 https://access.redhat.com/security/cve/CVE-2019-14858 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXbG09tzjgjWX9erEAQjG9RAAllK4FZgY7s+vICpCO8iFPkcp2Dp6S+y/ Bcm115Q7EjoPElkIG5RgKdj+HQa7C+dMuDz6QEPe2SGS7kcPfVkY8CqiX7H8lVpA +9/FWZ14Xc3wwm7ZBB0XXMzqJyav5DmgKzkGe4rxga1rCOp/5OSWG1GxaTb3UfdM KuTWxLH9L/oDHxwChDCAo0PUmvl9uKeyJisWgKQcrS4lJ5jMjvsHuPTRgR0krMHp 79OFjNEL+ZdwJRqcfEI2DvUsUdgF0J/Ou/IpQkRNeM80+kcMVkahtzNpxs9LZof6 n2c/MLSsPG5610s8loVQk7yU3r+1+ri3T2NKAPUL2OhqhlZELdlGOdAMn4EWoXv+ N9RNjPygXGAOrnKaOo9YKJ+Q5GKVSeLcQU/Vr/bmoG9APj/jhfEPy3wBtHMhUf/X H0iwjkEy8UDQ+NQKdmAfvMU1LqMnW6XmSJbiljpT6T7ZQB/YlibFeVpH6AzQWF7h RnZazSPfT/6ns+Mslz4UNksCWhVXizZuZ5htIJVhf5Tup4JcEKkpJoBivgBJbI3Z Focd0m2b7Yky7qU7D7EuaUAeEpz/H37MVuSXBYt5EwWkYhzsftb7IA4QzyFHqYRO WhUSMBWrlVSJ4n99wZoRiHUCxhJmKxhpD+0HeyQEg3jSIZEnwcl/u/Eb6bl10vXJ /WdkIaX7Bs0= =TwWE - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXbI9WmaOgq3Tt24GAQglsA/9Fq7lj+2K8Vd/3s5v1/YuVahWQ390ipVT wBffxVncBpBZci4w4nJWOz3LliyYRBafCKwKrPfK/lA/A/wJyESzK5i57Obls1wQ /rOsx1an6DrqtuQLdxeF2QOk3WL6r58QcOYZvMu99cX+qaxGrPCBrLbu569/UbsR HihvfFNeQDODxkuCxkLh6h+h5cmV0zms8WUie9hiLPVEz2NiXseHmXXv9AG2h5ZP OV5wi2zMil3Hczeg8riHAKyIpw2EIKyXu8KKVsD/ABzfxugxTXJKqhIgr+eHALMo w1N80J3oONcUSkKMXB0xJL8/KAHRfW/XUY43weQpeAetSNHDtqx+b+8rruJvgvqe fubemg7xl/hUo0PKXcKEKKazQwkEXecL4NGhSHief9MYm1tVITppsX5R9ahyFjhu U78YQ9M44B9v7Z/TQM9qXeGhx14Dm00De528rslfAUNRa5MqcxrI7lXgGYh1Vb+Q kzMmxud+0sRnV4PIAS5eJrb6XI1eZMu4fOX1egnSImcvv6k95Wkbu2IJaipF1a2p 5PNA9oL/Mo8bhjFNDzUhHUJF/eaQVWgDS3X0ofc+AZa5WnOEtj+jGgPoh6cbEvkz aaqmVTEYxYZ6fuF2FMCPVjnPTPZz51X37fSLmcX7W/IztmnnI7/DFKCm/xaSgREJ RBn+QN0dOnA= =i9Xv -----END PGP SIGNATURE-----