Debian alert DLA-3963-1 (ansible)

From:
             
 
rouca@debian.org
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 3963-1] ansible security update
Date:
             
 
Sun, 24 Nov 2024 10:46:54 +0000
Message-ID:
             
 
<ca4d3dc4b38b4679d513a0e8bfe08698@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3963-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Bastien Roucariès
November 23, 2024                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ansible
Version        : 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2
CVE ID         : CVE-2024-8775 CVE-2024-9902
Debian Bug     : 1082851

Ansible is a command-line IT automation software application.
It can configure systems, deploy software, and orchestrate
advanced workflows to support application deployment, system updates, ...

Ansible was affected by two vulnerabilities:

CVE-2024-8775

    A flaw was found in Ansible, where sensitive information stored in
    Ansible Vault files can be exposed in plaintext during the execution
    of a playbook. This occurs when using tasks such as include_vars to
    load vaulted variables without setting the no_log: true parameter,
    resulting in sensitive data being printed in the playbook output or
    logs. This can lead to the unintentional disclosure of secrets like
    passwords or API keys, compromising security and potentially
    allowing unauthorized access or actions.

CVE-2024-9902

    The ansible-core `user` module can allow an unprivileged user to
    silently create or replace the contents of any file on any system path
    and take ownership of it when a privileged user executes
    the `user` module against the unprivileged user's home directory.
    If the unprivileged user has traversal permissions on the directory
    containing the exploited target file, they retain full control
    over the contents of the file as its owner.

For Debian 11 bullseye, these problems have been fixed in version
2.10.7+merged+base+2.10.17+dfsg-0+deb11u2.

We recommend that you upgrade your ansible packages.

For the detailed security status of ansible please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ansible

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmdDBB0ACgkQADoaLapB
CF/JRxAApN1SgMajc1eGHfj21TsgB5qgxmjCI9eK8t0KIN8nLszCqdrARs5U+oj/
rYY66oCiuLZmWQDeAJ6BK9R/45ZAHAnedieAcEVTVEpzA8fpfA94aW/Gv2GbpFxq
nxsusycutYLNjQEiZuZ6AOIee0H9LZ3rqpJEQyIL+RUZxffU6xoDVuLtBnEdYW4+
6OS3II4QtUE9aVHIzBXpCg87Mve6KtfcIBcVoNG5GXpzJDkhHQIeljc6ZnshDhdT
2h24Jp6pke/qXvgcd7pWwVnPTaQ8vz5QQxsLQpeN5K7nMl5FVzGsnM0hQGONGGSg
yDxNyEXWRzAWdIu72HBSNYP/avV62gVxmSi/IJGy+JiSmQU1qRDVGv33E8S1fp0B
SW9c0pwCcKSSqCWbyybLBVa2rGwHwbl/UKj0/i13DNnnkLO6rqyKjxraT8KjZMs8
Z/bfdiGD5mw0Sg3fNM1DK8uZMX3MMAC0aB2qGm+5B/51UJhhMejDl8mqr3URawUf
3Y2R8ZMEA3gaNboFJdlh0Q/Ik5Kj++z1DaEBDD1+HuBYEZMX3aaoBzbNq13xoCQt
AXw9KZysWyE7Cruj9VFTUTITa35wHgfX51q2vKSYSiSOFx7E+1i5vtF1PiJA4dSA
U79idfarY5ogKyhQTWJRFOA3nyep1mkahuR3i4nbEcyyy3AESx8=
=erOd
-----END PGP SIGNATURE-----