First published: Thu Nov 17 2016(Updated: )
It is reported that in Ansible, under some circumstances the mysql_user module may fail to correctly change a password. Thus an old password may still be active when it should have been changed. External References: <a href="https://github.com/ansible/ansible-modules-core/pull/5388">https://github.com/ansible/ansible-modules-core/pull/5388</a>
Affected Software | Affected Version | How to fix |
---|---|---|
Ansible |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of REDHAT-BUG-1396174 is classified as moderate due to the potential for using an outdated password.
To fix REDHAT-BUG-1396174, ensure you are using the latest version of Ansible where the mysql_user module's functionality has been corrected.
The potential impacts of REDHAT-BUG-1396174 include unauthorized access if passwords are not updated as expected.
Several versions of Ansible preceding the fix could be affected by REDHAT-BUG-1396174, specifically those using the mysql_user module.
You should monitor user access and authentication attempts after using the mysql_user module to ensure that old passwords are not being accepted.