MGASA-2020-0363 - Updated ansible package fixes security vulnerabilities

Publication date: 05 Sep 2020
URL: https://advisories.mageia.org/MGASA-2020-0363.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-14430,
     CVE-2020-14432,
     CVE-2020-14365

An Improper Output Neutralization for Logs flaw was found in Ansible when using
the uri module, where sensitive data is exposed to content and json output.
This flaw allows an attacker to access the logs or outputs of performed tasks
to read keys used in playbooks from other users within the uri module. The
highest threat from this vulnerability is to data confidentiality
(CVE-2020-14430).

A flaw was found in the Ansible Engine when using module_args. Tasks executed
with check mode (--check-mode) do not properly neutralize sensitive data
exposed in the event data. This flaw allows unauthorized users to read this
data. The highest threat from this vulnerability is to confidentiality
(CVE-2020-14432).

A flaw was found in the Ansible Engine when installing packages using the dnf
module. GPG signatures are ignored during installation even when
disable_gpg_check is set to False, which is the default behavior. This flaw
leads to malicious packages being installed on the system and arbitrary code
executed via package installation scripts. The highest threat from this
vulnerability is to integrity and system availability (CVE-2020-14365).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27175
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/
- https://access.redhat.com/errata/RHSA-2020:3600
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14430
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14432
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14365

SRPMS:
- 7/core/ansible-2.7.18-1.1.mga7