PYSEC-2019-145: Medium severity Ansible Ansible vulnerability

Q: Which Ansible releases are affected?

Affected releases are Ansible 2.8.x before 2.8.4, 2.7.x before 2.7.13, and 2.6.x before 2.6.19.

Q: When is this issue reachable?

It is reachable when ansible-playbook is run with -k or when affected Ansible CLI tools prompt for a password that is expanded from a template.

Q: What makes a prompted password risky in this case?

Passwords containing special characters can trigger template expansion, potentially exposing the password.

Q: What mitigation is described if an update cannot be applied immediately?

Wrap prompted passwords to prevent template expansion from being triggered and exposing them.

Published Nov 22, 2019

Updated

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Affected Software

1 affected component

Ansible Ansible>=2.8.0<2.8.4, >=2.7.0<2.7.13, >=2.6.0<2.6.19

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ansible-playbook and Ansible CLI tools to a version that resolves this vulnerability.
Fixed in 2.8.4
Upgrade
Upgrade ansible-playbook and Ansible CLI tools to a version that resolves this vulnerability.
Fixed in 2.7.13
Upgrade
Upgrade ansible-playbook and Ansible CLI tools to a version that resolves this vulnerability.
Fixed in 2.6.19
Configuration
Wrap passwords when prompting them so password contents cannot trigger template expansion and be exposed.
ansible-playbook and Ansible CLI tools

Event History

Nov 22, 2019

CVE Published

via OSV·01:15 PM

Data Sourced

via OSV·01:15 PM

DescriptionSeverity

Frequently Asked Questions

Which Ansible releases are affected?

Affected releases are Ansible 2.8.x before 2.8.4, 2.7.x before 2.7.13, and 2.6.x before 2.6.19.

When is this issue reachable?

It is reachable when ansible-playbook is run with -k or when affected Ansible CLI tools prompt for a password that is expanded from a template.

What makes a prompted password risky in this case?

Passwords containing special characters can trigger template expansion, potentially exposing the password.

What mitigation is described if an update cannot be applied immediately?

Wrap prompted passwords to prevent template expansion from being triggered and exposing them.

PYSEC-2019-145: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ansible releases are affected?

When is this issue reachable?

What makes a prompted password risky in this case?

What mitigation is described if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which Ansible releases are affected?

When is this issue reachable?

What makes a prompted password risky in this case?

What mitigation is described if an update cannot be applied immediately?