Stay Secure with the Latest Linux Advisories

security advisoryinformation disclosureseverity moderate

Mageia: 2019-0234 Moderate: Ansible Information Leak via Substitution

Updated ansible package fixes security vulnerability: A flaw was discovered in the way Ansible templating was implemented before version 2.7.12, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable . MGASA-2019-0234 - Updated ansible packages fix security vulnerability Publication date: 31 Aug 2019 URL: https://advisories.mageia.org/MGASA-2019-0234.html Type: security Affected Mageia releases: 6, 7 CVE: CVE-2019-10156 Updated ansible package fixes security vulnerability: A flaw was discovered in the way Ansible templating was implemented before version 2.7.12, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed (CVE-2019-10156). Also, python-jmespath was added as a new dependency in Mageia 6. References: - https://bugs.mageia.org/show_bug.cgi?id=25285 - https://github.com/ansible/ansible/blob/stable-2.7/changelogs/CHANGELOG-v2.7.rst - https://ubuntu.com/security/notices/USN-4072-1 - https://www.cve.org/CVERecord?id=CVE-2019-10156 SRPMS: - 7/core/ansible-2.7.12-1.mga7 - 6/core/ansible-2.7.12-1.mga6 - 6/core/python-jmespath-0.9.4-1.2.mga6 . Latest Ansible updates in Mageia address significant data exposure vulnerability identified prior to the launch of version 2.7.12.. ansible update, Mageia security, information leak, package update. . LinuxSecurity.com Team

Aug 31, 2019 Mageia