MGASA-2020-0217 - Updated ansible packages fix security vulnerabilities

Publication date: 24 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0217.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-1733,
     CVE-2020-1735,
     CVE-2020-1737,
     CVE-2020-1739,
     CVE-2020-1740,
     CVE-2020-1746,
     CVE-2020-1753,
     CVE-2020-10684,
     CVE-2020-10684

Updated ansible package fixes security vulnerabilities:

A race condition flaw was found in Ansible Engine when running a playbook
with an unprivileged become user. When Ansible needs to run a module with
become user, the temporary directory is created in /var/tmp. This directory
is created with "umask 77 && mkdir -p "; this operation does not fail
if the directory already exists and is owned by another user. An attacker
could take advantage to gain control of the become user as the target
directory can be retrieved by iterating '/proc//cmdline'
(CVE-2020-1733).

A flaw was found in the Ansible Engine when the fetch module is used. An
attacker could intercept the module, inject a new path, and then choose a
new destination path on the controller node (CVE-2020-1735).

A flaw was found in the Ansible Engine when using the Extract-Zip function
from the win_unzip module as the extracted file(s) are not checked if they
belong to the destination folder. An attacker could take advantage of this
flaw by crafting an archive anywhere in the file system, using a path
traversal (CVE-2020-1737).

A flaw was found in Ansible Engine. When a password is set with the
argument "password" of svn module, it is used on svn command line,
disclosing to other users within the same node. An attacker could take
advantage by reading the cmdline file from that particular PID on the
procfs (CVE-2020-1739).

A flaw was found in Ansible Engine when using Ansible Vault for editing
encrypted files. When a user executes "ansible-vault edit", another user
on the same computer can read the old and new secret, as it is created in
a temporary file with mkstemp and the returned file descriptor is closed
and the method write_data is called to write the existing secret in the
file. This method will delete the file before recreating it insecurely
(CVE-2020-1740).

A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry
community modules are used. The issue discloses the LDAP bind password to
stdout or a log file if a playbook task is written using the bind_pw in
the parameters field. The highest threat from this vulnerability is data
confidentiality (CVE-2020-1746).

A security flaw was found in the Ansible Engine when managing Kubernetes
using the k8s connection plugin. Sensitive parameters such as passwords
and tokens are passed to the kubectl command line instead of using
environment variables or an input configuration file, which is safer.
This flaw discloses passwords and tokens from the process list, and the
no_log directive from the debug module would not be reflected in the
underlying command-line tools options, displaying passwords and tokens
on stdout and log files (CVE-2020-1753).

A flaw was found in the Ansible Engine. When using ansible_facts as a
subkeyof itself, and promoting it to a variable when injecting is enabled,
overwriting the ansible_facts after the clean, an attacker could take
advantage of this by altering the ansible_facts leading to privilege
escalation or code injection. The highest threat from this vulnerability
are to data integrity and system availability (CVE-2020-10684).

A flaw was found on Ansible Engine when using modules which decrypts vault
files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules.
The temporary directory is created in /tmp leaves the secrets unencrypted.
On Operating Systems which /tmp is not a tmpfs but part of the root
partition, the directory is only cleared on boot and the decrypted data
remains when the host is switched off. The system will be vulnerable when
the system is not running. So decrypted data must be cleared as soon as
possible and the data which normally is encrypted is sensible
(CVE-2020-10685).

References:
- https://bugs.mageia.org/show_bug.cgi?id=26349
- https://github.com/ansible/ansible/blob/v2.7.17/changelogs/CHANGELOG-v2.7.rst
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
- https://access.redhat.com/errata/RHSA-2020:1544
- https://access.redhat.com/errata/RHSA-2020:2142
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1733
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1735
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1737
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1739
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1740
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1753
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10684
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10684

SRPMS:
- 7/core/ansible-2.7.18-1.mga7