Mageia alert MGASA-2018-0303 (ansible)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2018-0303: Updated ansible packages fix security vulnerability 
Date:
    	     
 
Sun, 1 Jul 2018 19:18:07 +0200
Message-ID:
    	     
 
<20180701171807.92B8FA011E@duvel.mageia.org>
MGASA-2018-0303 - Updated ansible packages fix security vulnerability

Publication date: 01 Jul 2018
URL: https://advisories.mageia.org/MGASA-2018-0303.html
Type: security
Affected Mageia releases: 5, 6
CVE: CVE-2018-10855

Description:
Ansible prior to 2.4.5 does not honor the no_log task flag for failed
tasks.  When the no_log flag has been used to protect sensitive data
passed to a task from being logged, and that task does not run
successfully, Ansible will expose sensitive data in log files and on the
terminal of the user running Ansible (CVE-2018-10855).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23225
- https://github.com/ansible/ansible/blob/stable-2.4/CHANGE...
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...

SRPMS:
- 5/core/ansible-2.4.5.0-1.1.mga5
- 6/core/ansible-2.4.5.0-1.1.mga6