REDHAT-BUG-1396174: Low severity ansible vulnerability

Published Nov 17, 2016

Updated

It is reported that in Ansible, under some circumstances the mysqluser module may fail to correctly change a password. Thus an old password may still be active when it should have been changed.

External References: https://github.com/ansible/ansible-modules-core/pull/5388

Affected Software

1 affected component

Ansible Ansible

Event History

Nov 17, 2016

Data Sourced

via Red Hat·04:48 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1396174?

The severity of REDHAT-BUG-1396174 is classified as moderate due to the potential for using an outdated password.

How do I fix REDHAT-BUG-1396174?

To fix REDHAT-BUG-1396174, ensure you are using the latest version of Ansible where the mysql_user module's functionality has been corrected.

What are the potential impacts of REDHAT-BUG-1396174?

The potential impacts of REDHAT-BUG-1396174 include unauthorized access if passwords are not updated as expected.

Which versions of Ansible are affected by REDHAT-BUG-1396174?

Several versions of Ansible preceding the fix could be affected by REDHAT-BUG-1396174, specifically those using the mysql_user module.

What should I monitor for related to REDHAT-BUG-1396174?

You should monitor user access and authentication attempts after using the mysql_user module to ensure that old passwords are not being accepted.