Debian 8 LTS: DLA-1923-1 Moderate: Ansible Security Update Details

debian lts

September 16, 2019

Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system

Topics Covered

security advisory debian attack information disclosure man-in-the-middle ansible

Summary

CVE-2015-3908

A potential man-in-the-middle attack associated with insusfficient
X.509 certificate verification. Ansible did not verify that the
server hostname matches a domain name in the subject's Common Name
(CN) or subjectAltName field of the X.509 certificate, which allows
man-in-the-middle attackers to spoof SSL servers via an arbitrary
valid certificate.

CVE-2015-6240

A symlink attack that allows local users to escape a restricted
environment (chroot or jail) via a symlink attack.

CVE-2018-10875

A fix potential arbitrary code execution resulting from reading
ansible.cfg from a world-writable current working directory. This
condition now causes ansible to emit a warning and ignore the
ansible.cfg in the world-writable current working directory.

CVE-2019-10156

Information disclosure through unexpected variable substitution.

For Debian 8 "Jessie", these problems have been fixed in version
1.7.2+dfsg-2+deb8u2.