Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information.
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
A security flaw was found in the way Ansible, a SSH-based configuration management, deployment, and task execution system, performed remote server's SSH host key management (previously ability to store known SSH server's host keys to local cache was not supported). A remote attacker could use this flaw to conduct man-in-the-middle (MiTM) attacks against the Ansible task execution system user.
References: [1] http://www.openwall.com/lists/oss-security/2013/07/01/2 [2] http://www.openwall.com/lists/oss-security/2013/07/02/6
Upstream bug (no upstream patch as of 2013-07-03): [3] https://github.com/ansible/ansible/issues/857
The ansible-core user module contains an exploitable flaw that can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the user module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
Requirements to exploit (if any) - Someone with root privileges must use the user module with thegeneratesshkey option (disabled by default) and targeting an unprivileged user. - Access to the same unprivileged user on a system managed by the above automation.
It is reported that in Ansible, under some circumstances the mysqluser module may fail to correctly change a password. Thus an old password may still be active when it should have been changed.
External References: https://github.com/ansible/ansible-modules-core/pull/5388
End of life: 12/6/2023, Latest version: 8.7.0
End of life: 12/6/2023, Latest version: 8.7.0
End of life: 6/22/2023, Latest version: 7.7.0
End of life: 6/22/2023, Latest version: 7.7.0
End of life: 6/8/2022, Latest version: 5.10.0
End of life: 6/8/2022, Latest version: 5.10.0
End of life: 12/6/2022, Latest version: 6.7.0
End of life: 12/14/2021, Latest version: 4.10.0
End of life: 12/6/2022, Latest version: 6.7.0
End of life: 12/14/2021, Latest version: 4.10.0
End of life: 5/11/2021, Latest version: 3.4.0
End of life: 5/11/2021, Latest version: 3.4.0
End of life: 2/9/2021, Latest version: 2.10.7
End of life: 2/9/2021, Latest version: 2.10.7
Running inventories of ~60k hosts no longer takes a very long time for events to show up Removed artifactdata from data sent to analytics as part of playbookonstats, since artifactdata can contain PII or sensitive data Regular users are no longer experiencing longer load times than a superuser when clicking to edit a job template Updated password validation support to allow modifying password complexity requirements using some Django configurations Fixed AWS inventory tags filtering to support the OR condition Updated Ansible version to 2.9.25 Updated Django version to 2.2.20 Fixed Tower's NGINX Instance vulnerability (CVE-2021-23017)