Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-10874 (GCVE-0-2018-10874)
Vulnerability from cvelistv5
Published
2018-07-02 13:00
Modified
2024-08-05 07:46
Severity ?
EPSS score ?
Summary
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-05T07:46:47.224Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "RHSA-2018:2166", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { name: "RHSA-2018:2152", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { name: "RHSA-2018:2150", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { name: "1041396", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://www.securitytracker.com/id/1041396", }, { name: "RHBA-2018:3788", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { name: "RHSA-2019:0054", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { name: "RHSA-2018:2151", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { name: "RHSA-2018:2321", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { name: "RHSA-2018:2585", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { name: "USN-4072-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred", ], url: "https://usn.ubuntu.com/4072-1/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "ansible", vendor: "[UNKNOWN]", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2018-06-29T00:00:00", descriptions: [ { lang: "en", value: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", }, ], metrics: [ { cvssV3_0: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-426", description: "CWE-426", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2019-07-25T01:06:05", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "RHSA-2018:2166", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { name: "RHSA-2018:2152", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { name: "RHSA-2018:2150", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { name: "1041396", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://www.securitytracker.com/id/1041396", }, { name: "RHBA-2018:3788", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { name: "RHSA-2019:0054", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { name: "RHSA-2018:2151", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { name: "RHSA-2018:2321", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { name: "RHSA-2018:2585", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { name: "USN-4072-1", tags: [ "vendor-advisory", "x_refsource_UBUNTU", ], url: "https://usn.ubuntu.com/4072-1/", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2018-10874", datePublished: "2018-07-02T13:00:00", dateReserved: "2018-05-09T00:00:00", dateUpdated: "2024-08-05T07:46:47.224Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8989CD03-49A1-4831-BF98-9F21592788BE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5864D753-2A37-4800-A73E-6ACA0662B605\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C5A40D5-4DF7-43D9-962E-1529D2DF198D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"13BACD7C-AC7E-4D86-8D9B-ABB614005D0C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D4AC996-B340-4A14-86F7-FF83B4D5EC8F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"704CFA1A-953E-4105-BFBE-406034B83DED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6BBD7A51-0590-4DDF-8249-5AFA8D645CB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BB28F9AF-3D06-4532-B397-96D7E4792503\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.\"}, {\"lang\": \"es\", \"value\": \"En Ansible, se ha descubierto que las variables de inventario se cargan desde el directorio de trabajo actual cuando se ejecutan comandos ad-hoc bajo el control del atacante, lo que permite la ejecuci\\u00f3n de c\\u00f3digo arbitrario como resultado.\"}]", id: "CVE-2018-10874", lastModified: "2024-11-21T03:42:11.677", metrics: "{\"cvssMetricV30\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", published: "2018-07-02T13:29:00.367", references: "[{\"url\": \"http://www.securitytracker.com/id/1041396\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/errata/RHBA-2018:3788\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2150\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2151\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2152\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2166\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2321\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2585\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:0054\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4072-1/\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.securitytracker.com/id/1041396\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://access.redhat.com/errata/RHBA-2018:3788\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2150\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2151\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2152\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2166\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2321\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:2585\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:0054\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4072-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]", sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-426\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2018-10874\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2018-07-02T13:29:00.367\",\"lastModified\":\"2024-11-21T03:42:11.677\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.\"},{\"lang\":\"es\",\"value\":\"En Ansible, se ha descubierto que las variables de inventario se cargan desde el directorio de trabajo actual cuando se ejecutan comandos ad-hoc bajo el control del atacante, lo que permite la ejecución de código arbitrario como resultado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8989CD03-49A1-4831-BF98-9F21592788BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5864D753-2A37-4800-A73E-6ACA0662B605\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C5A40D5-4DF7-43D9-962E-1529D2DF198D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13BACD7C-AC7E-4D86-8D9B-ABB614005D0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D4AC996-B340-4A14-86F7-FF83B4D5EC8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"704CFA1A-953E-4105-BFBE-406034B83DED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BBD7A51-0590-4DDF-8249-5AFA8D645CB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB28F9AF-3D06-4532-B397-96D7E4792503\"}]}]}],\"references\":[{\"url\":\"http://www.securitytracker.com/id/1041396\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHBA-2018:3788\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2150\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2151\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2152\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2166\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2321\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2585\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:0054\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4072-1/\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securitytracker.com/id/1041396\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHBA-2018:3788\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2150\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2151\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2152\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2166\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2321\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:2585\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:0054\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4072-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", }, }
WID-SEC-W-2024-0959
Vulnerability from csaf_certbund
Published
2018-07-10 22:00
Modified
2024-12-03 23:00
Summary
Ansible: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,
zum Konfigurationsmanagement und zur Anwendungsbereitstellung.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,\r\nzum Konfigurationsmanagement und zur Anwendungsbereitstellung.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0959 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2024-0959.json", }, { category: "self", summary: "WID-SEC-2024-0959 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0959", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2150 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2151 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2152 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2166 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2018:2321 vom 2018-08-01", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2018:2585 vom 2018-08-30", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2018:4130-1 vom 2018-12-15", url: "https://www.suse.com/support/update/announcement/2018/suse-su-20184130-1.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2019:0054 vom 2019-01-16", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { category: "external", summary: "Debian Security Advisory DSA-4396 vom 2019-02-20", url: "https://www.debian.org/security/2019/dsa-4396", }, { category: "external", summary: "Ubuntu Security Notice USN-4072-1 vom 2019-07-25", url: "https://usn.ubuntu.com/4072-1/", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2020:3309-1 vom 2020-11-12", url: "https://lists.suse.com/pipermail/sle-security-updates/2020-November/007763.html", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1427-1 vom 2024-04-24", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018418.html", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1509-1 vom 2024-05-06", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018463.html", }, { category: "external", summary: "openSUSE Security Update OPENSUSE-SU-2024:14536-1 vom 2024-12-03", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7LWEIR2LXW4QRWCY6HDMLUO2OTX5OZIC/", }, ], source_lang: "en-US", title: "Ansible: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode", tracking: { current_release_date: "2024-12-03T23:00:00.000+00:00", generator: { date: "2024-12-04T11:21:02.729+00:00", engine: { name: "BSI-WID", version: "1.3.10", }, }, id: "WID-SEC-W-2024-0959", initial_release_date: "2018-07-10T22:00:00.000+00:00", revision_history: [ { date: "2018-07-10T22:00:00.000+00:00", number: "1", summary: "Initial Release", }, { date: "2018-07-10T22:00:00.000+00:00", number: "2", summary: "Version nicht vorhanden", }, { date: "2018-07-10T22:00:00.000+00:00", number: "3", summary: "Version nicht vorhanden", }, { date: "2018-08-01T22:00:00.000+00:00", number: "4", summary: "New remediations available", }, { date: "2018-08-01T22:00:00.000+00:00", number: "5", summary: "Version nicht vorhanden", }, { date: "2018-08-01T22:00:00.000+00:00", number: "6", summary: "Version nicht vorhanden", }, { date: "2018-08-29T22:00:00.000+00:00", number: "7", summary: "New remediations available", }, { date: "2018-12-16T23:00:00.000+00:00", number: "8", summary: "New remediations available", }, { date: "2019-01-16T23:00:00.000+00:00", number: "9", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2019-02-19T23:00:00.000+00:00", number: "10", summary: "Neue Updates von Debian aufgenommen", }, { date: "2019-07-24T22:00:00.000+00:00", number: "11", summary: "Neue Updates von Ubuntu aufgenommen", }, { date: "2020-11-12T23:00:00.000+00:00", number: "12", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-04-24T22:00:00.000+00:00", number: "13", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-05-06T22:00:00.000+00:00", number: "14", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-12-03T23:00:00.000+00:00", number: "15", summary: "Neue Updates von openSUSE aufgenommen", }, ], status: "final", version: "15", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Open Source Ansible", product: { name: "Open Source Ansible", product_id: "T010090", product_identification_helper: { cpe: "cpe:/a:open_source:ansible:-", }, }, }, ], category: "vendor", name: "Open Source", }, { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, { branches: [ { category: "product_version", name: "4", product: { name: "Red Hat Enterprise Virtualization 4", product_id: "T012491", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_virtualization:4", }, }, }, ], category: "product_name", name: "Enterprise Virtualization", }, { category: "product_name", name: "Red Hat OpenShift Enterprise", product: { name: "Red Hat OpenShift Enterprise", product_id: "T012286", product_identification_helper: { cpe: "cpe:/a:redhat:openshift:3", }, }, }, { category: "product_name", name: "Red Hat OpenStack", product: { name: "Red Hat OpenStack", product_id: "T003522", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:-", }, }, }, { branches: [ { category: "product_version", name: "6", product: { name: "Red Hat Satellite 6", product_id: "T012490", product_identification_helper: { cpe: "cpe:/a:redhat:satellite:6", }, }, }, ], category: "product_name", name: "Satellite", }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, { category: "product_name", name: "SUSE openSUSE", product: { name: "SUSE openSUSE", product_id: "T027843", product_identification_helper: { cpe: "cpe:/o:suse:opensuse:-", }, }, }, ], category: "vendor", name: "SUSE", }, { branches: [ { category: "product_name", name: "Ubuntu Linux", product: { name: "Ubuntu Linux", product_id: "T000126", product_identification_helper: { cpe: "cpe:/o:canonical:ubuntu_linux:-", }, }, }, ], category: "vendor", name: "Ubuntu", }, ], }, vulnerabilities: [ { cve: "CVE-2018-10874", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Ansible. Wenn ein lokaler Angreifer Ad-hoc-Befehle ausführt, werden Inventory-Variablen aus dem aktuellen Arbeitsverzeichnis geladen. In der Folge kann der Angreifer beliebigen Code zur Ausführung bringen.", }, ], product_status: { known_affected: [ "T012490", "T010090", "T012491", "2951", "T002207", "67646", "T000126", "T003522", "T027843", "T012286", ], }, release_date: "2018-07-10T22:00:00.000+00:00", title: "CVE-2018-10874", }, { cve: "CVE-2018-10875", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Ansible. Die ansible.cfg wird aus dem aktuellen Arbeitsverzeichnis gelesen, was es einem lokalen Angreifer ermöglicht beliebigen Code zur Ausführung zu bringen.", }, ], product_status: { known_affected: [ "T012490", "T010090", "T012491", "2951", "T002207", "67646", "T000126", "T003522", "T027843", "T012286", ], }, release_date: "2018-07-10T22:00:00.000+00:00", title: "CVE-2018-10875", }, ], }
wid-sec-w-2024-0959
Vulnerability from csaf_certbund
Published
2018-07-10 22:00
Modified
2024-12-03 23:00
Summary
Ansible: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,
zum Konfigurationsmanagement und zur Anwendungsbereitstellung.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen.
Betroffene Betriebssysteme
- Linux
{ document: { aggregate_severity: { text: "mittel", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,\r\nzum Konfigurationsmanagement und zur Anwendungsbereitstellung.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2024-0959 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2024-0959.json", }, { category: "self", summary: "WID-SEC-2024-0959 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0959", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2150 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2151 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2152 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { category: "external", summary: "RedHat Security Advisory RHSA-2018:2166 vom 2018-07-10", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2018:2321 vom 2018-08-01", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2018:2585 vom 2018-08-30", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2018:4130-1 vom 2018-12-15", url: "https://www.suse.com/support/update/announcement/2018/suse-su-20184130-1.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2019:0054 vom 2019-01-16", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { category: "external", summary: "Debian Security Advisory DSA-4396 vom 2019-02-20", url: "https://www.debian.org/security/2019/dsa-4396", }, { category: "external", summary: "Ubuntu Security Notice USN-4072-1 vom 2019-07-25", url: "https://usn.ubuntu.com/4072-1/", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2020:3309-1 vom 2020-11-12", url: "https://lists.suse.com/pipermail/sle-security-updates/2020-November/007763.html", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1427-1 vom 2024-04-24", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018418.html", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2024:1509-1 vom 2024-05-06", url: "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018463.html", }, { category: "external", summary: "openSUSE Security Update OPENSUSE-SU-2024:14536-1 vom 2024-12-03", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7LWEIR2LXW4QRWCY6HDMLUO2OTX5OZIC/", }, ], source_lang: "en-US", title: "Ansible: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode", tracking: { current_release_date: "2024-12-03T23:00:00.000+00:00", generator: { date: "2024-12-04T11:21:02.729+00:00", engine: { name: "BSI-WID", version: "1.3.10", }, }, id: "WID-SEC-W-2024-0959", initial_release_date: "2018-07-10T22:00:00.000+00:00", revision_history: [ { date: "2018-07-10T22:00:00.000+00:00", number: "1", summary: "Initial Release", }, { date: "2018-07-10T22:00:00.000+00:00", number: "2", summary: "Version nicht vorhanden", }, { date: "2018-07-10T22:00:00.000+00:00", number: "3", summary: "Version nicht vorhanden", }, { date: "2018-08-01T22:00:00.000+00:00", number: "4", summary: "New remediations available", }, { date: "2018-08-01T22:00:00.000+00:00", number: "5", summary: "Version nicht vorhanden", }, { date: "2018-08-01T22:00:00.000+00:00", number: "6", summary: "Version nicht vorhanden", }, { date: "2018-08-29T22:00:00.000+00:00", number: "7", summary: "New remediations available", }, { date: "2018-12-16T23:00:00.000+00:00", number: "8", summary: "New remediations available", }, { date: "2019-01-16T23:00:00.000+00:00", number: "9", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2019-02-19T23:00:00.000+00:00", number: "10", summary: "Neue Updates von Debian aufgenommen", }, { date: "2019-07-24T22:00:00.000+00:00", number: "11", summary: "Neue Updates von Ubuntu aufgenommen", }, { date: "2020-11-12T23:00:00.000+00:00", number: "12", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-04-24T22:00:00.000+00:00", number: "13", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-05-06T22:00:00.000+00:00", number: "14", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-12-03T23:00:00.000+00:00", number: "15", summary: "Neue Updates von openSUSE aufgenommen", }, ], status: "final", version: "15", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Open Source Ansible", product: { name: "Open Source Ansible", product_id: "T010090", product_identification_helper: { cpe: "cpe:/a:open_source:ansible:-", }, }, }, ], category: "vendor", name: "Open Source", }, { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, { branches: [ { category: "product_version", name: "4", product: { name: "Red Hat Enterprise Virtualization 4", product_id: "T012491", product_identification_helper: { cpe: "cpe:/a:redhat:enterprise_virtualization:4", }, }, }, ], category: "product_name", name: "Enterprise Virtualization", }, { category: "product_name", name: "Red Hat OpenShift Enterprise", product: { name: "Red Hat OpenShift Enterprise", product_id: "T012286", product_identification_helper: { cpe: "cpe:/a:redhat:openshift:3", }, }, }, { category: "product_name", name: "Red Hat OpenStack", product: { name: "Red Hat OpenStack", product_id: "T003522", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:-", }, }, }, { branches: [ { category: "product_version", name: "6", product: { name: "Red Hat Satellite 6", product_id: "T012490", product_identification_helper: { cpe: "cpe:/a:redhat:satellite:6", }, }, }, ], category: "product_name", name: "Satellite", }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, { category: "product_name", name: "SUSE openSUSE", product: { name: "SUSE openSUSE", product_id: "T027843", product_identification_helper: { cpe: "cpe:/o:suse:opensuse:-", }, }, }, ], category: "vendor", name: "SUSE", }, { branches: [ { category: "product_name", name: "Ubuntu Linux", product: { name: "Ubuntu Linux", product_id: "T000126", product_identification_helper: { cpe: "cpe:/o:canonical:ubuntu_linux:-", }, }, }, ], category: "vendor", name: "Ubuntu", }, ], }, vulnerabilities: [ { cve: "CVE-2018-10874", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Ansible. Wenn ein lokaler Angreifer Ad-hoc-Befehle ausführt, werden Inventory-Variablen aus dem aktuellen Arbeitsverzeichnis geladen. In der Folge kann der Angreifer beliebigen Code zur Ausführung bringen.", }, ], product_status: { known_affected: [ "T012490", "T010090", "T012491", "2951", "T002207", "67646", "T000126", "T003522", "T027843", "T012286", ], }, release_date: "2018-07-10T22:00:00.000+00:00", title: "CVE-2018-10874", }, { cve: "CVE-2018-10875", notes: [ { category: "description", text: "Es existiert eine Schwachstelle in Ansible. Die ansible.cfg wird aus dem aktuellen Arbeitsverzeichnis gelesen, was es einem lokalen Angreifer ermöglicht beliebigen Code zur Ausführung zu bringen.", }, ], product_status: { known_affected: [ "T012490", "T010090", "T012491", "2951", "T002207", "67646", "T000126", "T003522", "T027843", "T012286", ], }, release_date: "2018-07-10T22:00:00.000+00:00", title: "CVE-2018-10875", }, ], }
rhsa-2018:2150
Vulnerability from csaf_redhat
Published
2018-07-10 09:49
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.5.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.5.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.
* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)
* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)
* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)
* correct debug display for all cases https://github.com/ansible/ansible/pull/41331
* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)
* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)
* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'
* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).
* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)
* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520
* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809
* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819
* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874
* win_updates - Fixed issue where running win_updates on async fails without any error
* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.5.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.5.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.\n\n* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)\n\n* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)\n\n* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)\n\n* correct debug display for all cases https://github.com/ansible/ansible/pull/41331\n\n* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)\n\n* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)\n\n* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'\n\n* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).\n\n* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)\n\n* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520\n\n* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809\n\n* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819\n\n* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874\n\n* win_updates - Fixed issue where running win_updates on async fails without any error\n\n* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2150", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2150.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:54+00:00", generator: { date: "2024-11-14T23:43:54+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2150", initial_release_date: "2018-07-10T09:49:17+00:00", revision_history: [ { date: "2018-07-10T09:49:17+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T09:49:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:54+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.5::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.src", product: { name: "ansible-0:2.5.6-1.el7ae.src", product_id: "ansible-0:2.5.6-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-0:2.5.6-1.el7ae.noarch", product_id: "ansible-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_id: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.5.6-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.src as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", }, product_reference: "ansible-0:2.5.6-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2585
Vulnerability from csaf_redhat
Published
2018-08-29 16:05
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat
OpenStack Platform 13.0 (Queens).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.5)
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat\nOpenStack Platform 13.0 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.5)\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2585", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2585.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:44:48+00:00", generator: { date: "2024-11-14T23:44:48+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2585", initial_release_date: "2018-08-29T16:05:26+00:00", revision_history: [ { date: "2018-08-29T16:05:26+00:00", number: "1", summary: "Initial version", }, { date: "2018-08-29T16:05:26+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:48+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2152
Vulnerability from csaf_redhat
Published
2018-07-10 12:56
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2152", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2152.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:43:49+00:00", generator: { date: "2024-11-14T23:43:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2152", initial_release_date: "2018-07-10T12:56:37+00:00", revision_history: [ { date: "2018-07-10T12:56:37+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T12:56:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.4::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2150
Vulnerability from csaf_redhat
Published
2018-07-10 09:49
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.5.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.5.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.
* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)
* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)
* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)
* correct debug display for all cases https://github.com/ansible/ansible/pull/41331
* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)
* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)
* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'
* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).
* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)
* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520
* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809
* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819
* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874
* win_updates - Fixed issue where running win_updates on async fails without any error
* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.5.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.5.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.\n\n* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)\n\n* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)\n\n* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)\n\n* correct debug display for all cases https://github.com/ansible/ansible/pull/41331\n\n* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)\n\n* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)\n\n* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'\n\n* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).\n\n* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)\n\n* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520\n\n* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809\n\n* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819\n\n* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874\n\n* win_updates - Fixed issue where running win_updates on async fails without any error\n\n* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2150", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2150.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:54+00:00", generator: { date: "2024-11-14T23:43:54+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2150", initial_release_date: "2018-07-10T09:49:17+00:00", revision_history: [ { date: "2018-07-10T09:49:17+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T09:49:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:54+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.5::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.src", product: { name: "ansible-0:2.5.6-1.el7ae.src", product_id: "ansible-0:2.5.6-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-0:2.5.6-1.el7ae.noarch", product_id: "ansible-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_id: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.5.6-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.src as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", }, product_reference: "ansible-0:2.5.6-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2150
Vulnerability from csaf_redhat
Published
2018-07-10 09:49
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.5.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.5.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.
* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)
* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)
* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)
* correct debug display for all cases https://github.com/ansible/ansible/pull/41331
* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)
* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)
* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'
* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).
* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)
* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520
* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809
* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819
* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874
* win_updates - Fixed issue where running win_updates on async fails without any error
* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.5.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.5.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Restore module_utils.basic.BOOLEANS variable for backwards compatibility with the module API in older ansible releases.\n\n* lineinfile - add warning when using an empty regexp (https://github.com/ansible/ansible/issues/29443)\n\n* apt - fix apt-mark on debian6 (https://github.com/ansible/ansible/pull/41530)\n\n* copy module - fixed recursive copy with relative paths (https://github.com/ansible/ansible/pull/40166)\n\n* correct debug display for all cases https://github.com/ansible/ansible/pull/41331\n\n* eos_l2_interface - fix eapi (https://github.com/ansible/ansible/pull/42270)\n\n* group_by - support implicit localhost (https://github.com/ansible/ansible/pull/41860)\n\n* influxdb_query - fixed the use of the common return 'results' caused an unexpected fault. The return is renamed to 'query_results'\n\n* junos_config - fix confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* lineinfile - fix insertbefore when used with BOF to not insert duplicate lines (https://github.com/ansible/ansible/issues/38219)\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* nxos_linkagg - fix issue (https://github.com/ansible/ansible/pull/41550).\n\n* nxos_vxlan_vtep_vni - fix issue (https://github.com/ansible/ansible/pull/42240)\n\n* uses correct conn info for reset_connection https://github.com/ansible/ansible/issues/27520\n\n* correct service facts systemd detection of state https://github.com/ansible/ansible/issues/40809\n\n* correctly check hostvars for vars term https://github.com/ansible/ansible/pull/41819\n\n* vyos_vlan - fix aggregate configuration issues (https://github.com/ansible/ansible/pull/41638)\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_iis_webapppool - redirect some module output to null so Ansible can read the output JSON https://github.com/ansible/ansible/issues/40874\n\n* win_updates - Fixed issue where running win_updates on async fails without any error\n\n* winrm - ensure pexpect is set to not echo the input on a failure and have a manual sanity check afterwards https://github.com/ansible/ansible/issues/41865", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2150", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2150.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:54+00:00", generator: { date: "2024-11-14T23:43:54+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2150", initial_release_date: "2018-07-10T09:49:17+00:00", revision_history: [ { date: "2018-07-10T09:49:17+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T09:49:17+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:54+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.5::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.src", product: { name: "ansible-0:2.5.6-1.el7ae.src", product_id: "ansible-0:2.5.6-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-0:2.5.6-1.el7ae.noarch", product_id: "ansible-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.5.6-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_id: "ansible-doc-0:2.5.6-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.5.6-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.5.6-1.el7ae.src as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", }, product_reference: "ansible-0:2.5.6-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.5", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.5.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.5 for RHEL 7 Server", product_id: "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.5.6-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.5", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T09:49:17+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2150", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.noarch", "7Server-Ansible-2.5:ansible-0:2.5.6-1.el7ae.src", "7Server-Ansible-2.5:ansible-doc-0:2.5.6-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2151
Vulnerability from csaf_redhat
Published
2018-07-10 11:33
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2151", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2151.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:59+00:00", generator: { date: "2024-11-14T23:43:59+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2151", initial_release_date: "2018-07-10T11:33:04+00:00", revision_history: [ { date: "2018-07-10T11:33:04+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T11:33:04+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:59+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2 for RHEL 7", product: { name: "Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2151
Vulnerability from csaf_redhat
Published
2018-07-10 11:33
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2151", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2151.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:59+00:00", generator: { date: "2024-11-14T23:43:59+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2151", initial_release_date: "2018-07-10T11:33:04+00:00", revision_history: [ { date: "2018-07-10T11:33:04+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T11:33:04+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:59+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2 for RHEL 7", product: { name: "Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2166
Vulnerability from csaf_redhat
Published
2018-07-10 17:20
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2166", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2166.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:44:11+00:00", generator: { date: "2024-11-14T23:44:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2166", initial_release_date: "2018-07-10T17:20:27+00:00", revision_history: [ { date: "2018-07-10T17:20:27+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T17:20:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.6::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.6", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.6", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018:2152
Vulnerability from csaf_redhat
Published
2018-07-10 12:56
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2152", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2152.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:43:49+00:00", generator: { date: "2024-11-14T23:43:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2152", initial_release_date: "2018-07-10T12:56:37+00:00", revision_history: [ { date: "2018-07-10T12:56:37+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T12:56:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.4::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2585
Vulnerability from csaf_redhat
Published
2018-08-29 16:05
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat
OpenStack Platform 13.0 (Queens).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.5)
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat\nOpenStack Platform 13.0 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.5)\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2585", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2585.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:44:48+00:00", generator: { date: "2024-11-14T23:44:48+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2585", initial_release_date: "2018-08-29T16:05:26+00:00", revision_history: [ { date: "2018-08-29T16:05:26+00:00", number: "1", summary: "Initial version", }, { date: "2018-08-29T16:05:26+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:48+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018:2151
Vulnerability from csaf_redhat
Published
2018-07-10 11:33
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2151", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2151.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:43:59+00:00", generator: { date: "2024-11-14T23:43:59+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2151", initial_release_date: "2018-07-10T11:33:04+00:00", revision_history: [ { date: "2018-07-10T11:33:04+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T11:33:04+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:59+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2 for RHEL 7", product: { name: "Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7", product_id: "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T11:33:04+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2151", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018:2321
Vulnerability from csaf_redhat
Published
2018-07-31 17:49
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
Notes
Topic
An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)
Security Fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)\n\nSecurity Fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2321", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "1596545", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596545", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2321.json", }, ], title: "Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update", tracking: { current_release_date: "2024-11-14T23:44:36+00:00", generator: { date: "2024-11-14T23:44:36+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2321", initial_release_date: "2018-07-31T17:49:32+00:00", revision_history: [ { date: "2018-07-31T17:49:32+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-31T17:49:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:36+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product: { name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, { category: "product_name", name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product: { name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, ], category: "product_family", name: "Red Hat Virtualization", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=src", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.src", product: { name: "imgbased-0:1.0.22-1.el7ev.src", product_id: "imgbased-0:1.0.22-1.el7ev.src", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=src", }, }, }, { category: "product_version", name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_id: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host@4.2-20180724.0.el7_5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_id: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.2-5.0.el7?arch=noarch", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "imgbased-0:1.0.22-1.el7ev.noarch", product_id: "imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_id: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/python-imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_id: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.2-20180724.0.el7_5?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", }, product_reference: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", }, product_reference: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", }, product_reference: "imgbased-0:1.0.22-1.el7ev.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "python-imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", }, product_reference: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018:2585
Vulnerability from csaf_redhat
Published
2018-08-29 16:05
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat
OpenStack Platform 13.0 (Queens).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.5)
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat\nOpenStack Platform 13.0 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.5)\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH), Brian Coca (Red Hat), and Michael Scherer (OSAS) for reporting this issue.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2585", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2585.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:44:48+00:00", generator: { date: "2024-11-14T23:44:48+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2585", initial_release_date: "2018-08-29T16:05:26+00:00", revision_history: [ { date: "2018-08-29T16:05:26+00:00", number: "1", summary: "Initial version", }, { date: "2018-08-29T16:05:26+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:48+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, { category: "product_name", name: "Red Hat OpenStack Platform 13.0", product: { name: "Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:13::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 13.0", product_id: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-08-29T16:05:26+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2585", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-13.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-DEPLOYMENT-TOOLS-13.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2019:0054
Vulnerability from csaf_redhat
Published
2019-01-16 17:11
Modified
2024-11-14 23:47
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:0054", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0054.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:47:16+00:00", generator: { date: "2024-11-14T23:47:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:0054", initial_release_date: "2019-01-16T17:11:06+00:00", revision_history: [ { date: "2019-01-16T17:11:06+00:00", number: "1", summary: "Initial version", }, { date: "2019-01-16T17:11:06+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:47:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 10.0", product: { name: "Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:10::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2321
Vulnerability from csaf_redhat
Published
2018-07-31 17:49
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
Notes
Topic
An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)
Security Fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)\n\nSecurity Fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2321", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "1596545", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596545", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2321.json", }, ], title: "Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update", tracking: { current_release_date: "2024-11-14T23:44:36+00:00", generator: { date: "2024-11-14T23:44:36+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2321", initial_release_date: "2018-07-31T17:49:32+00:00", revision_history: [ { date: "2018-07-31T17:49:32+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-31T17:49:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:36+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product: { name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, { category: "product_name", name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product: { name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, ], category: "product_family", name: "Red Hat Virtualization", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=src", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.src", product: { name: "imgbased-0:1.0.22-1.el7ev.src", product_id: "imgbased-0:1.0.22-1.el7ev.src", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=src", }, }, }, { category: "product_version", name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_id: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host@4.2-20180724.0.el7_5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_id: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.2-5.0.el7?arch=noarch", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "imgbased-0:1.0.22-1.el7ev.noarch", product_id: "imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_id: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/python-imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_id: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.2-20180724.0.el7_5?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", }, product_reference: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", }, product_reference: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", }, product_reference: "imgbased-0:1.0.22-1.el7ev.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "python-imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", }, product_reference: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhba-2018:3788
Vulnerability from csaf_redhat
Published
2018-12-05 19:01
Modified
2024-11-14 23:32
Summary
Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory
Notes
Topic
Updated packages that resolve various issues are now available for Red Hat
OpenStack Platform 12.0 (Pike) for RHEL 7.
Details
Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that resolve various issues are now available for Red Hat\nOpenStack Platform 12.0 (Pike) for RHEL 7.", title: "Topic", }, { category: "general", text: "Red Hat OpenStack Platform provides the facilities for building, deploying\nand monitoring a private or public infrastructure-as-a-service (IaaS) cloud\nrunning on commonly available physical hardware.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2018:3788", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { category: "external", summary: "1568591", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1568591", }, { category: "external", summary: "1644801", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1644801", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhba-2018_3788.json", }, ], title: "Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory", tracking: { current_release_date: "2024-11-14T23:32:57+00:00", generator: { date: "2024-11-14T23:32:57+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2018:3788", initial_release_date: "2018-12-05T19:01:13+00:00", revision_history: [ { date: "2018-12-05T19:01:13+00:00", number: "1", summary: "Initial version", }, { date: "2018-12-05T19:01:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:32:57+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 12.0", product: { name: "Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:12::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018_2166
Vulnerability from csaf_redhat
Published
2018-07-10 17:20
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2166", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2166.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:44:11+00:00", generator: { date: "2024-11-14T23:44:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2166", initial_release_date: "2018-07-10T17:20:27+00:00", revision_history: [ { date: "2018-07-10T17:20:27+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T17:20:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.6::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.6", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.6", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2019:0054
Vulnerability from csaf_redhat
Published
2019-01-16 17:11
Modified
2024-11-14 23:47
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:0054", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0054.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:47:16+00:00", generator: { date: "2024-11-14T23:47:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:0054", initial_release_date: "2019-01-16T17:11:06+00:00", revision_history: [ { date: "2019-01-16T17:11:06+00:00", number: "1", summary: "Initial version", }, { date: "2019-01-16T17:11:06+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:47:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 10.0", product: { name: "Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:10::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2018:2166
Vulnerability from csaf_redhat
Published
2018-07-10 17:20
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: ansible security and bug fix update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.6.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.6.1)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Bug Fix(es):
* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)
* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)
* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.
* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209
* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536
* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.6.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.6.1)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).\n\nBug Fix(es):\n\n* Fix junos_config confirm commit timeout issue (https://github.com/ansible/ansible/pull/41527)\n\n* file module - The touch subcommand had its diff output broken during the 2.6.x development cycle. The patch to fix that broke check mode. This is now fixed (https://github.com/ansible/ansible/issues/42111)\n\n* inventory manager - This fixes required options being populated before the inventory config file is read, so the required options may be set in the config file.\n\n* nsupdate - allow hmac-sha384 https://github.com/ansible/ansible/pull/42209\n\n* win_domain - fixes typo in one of the AD cmdlets https://github.com/ansible/ansible/issues/41536\n\n* win_group_membership - uses the internal Ansible SID conversion logic and uses that when comparing group membership instead of the name https://github.com/ansible/ansible/issues/40649", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2166", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2166.json", }, ], title: "Red Hat Security Advisory: ansible security and bug fix update", tracking: { current_release_date: "2024-11-14T23:44:11+00:00", generator: { date: "2024-11-14T23:44:11+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2166", initial_release_date: "2018-07-10T17:20:27+00:00", revision_history: [ { date: "2018-07-10T17:20:27+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T17:20:27+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:11+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.6::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.src", product: { name: "ansible-0:2.6.1-1.el7ae.src", product_id: "ansible-0:2.6.1-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.6.1-1.el7ae.noarch", product: { name: "ansible-0:2.6.1-1.el7ae.noarch", product_id: "ansible-0:2.6.1-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.6.1-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", }, product_reference: "ansible-0:2.6.1-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.6", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.6.1-1.el7ae.src as a component of Red Hat Ansible Engine 2.6 for RHEL 7 Server", product_id: "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", }, product_reference: "ansible-0:2.6.1-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.6", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T17:20:27+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2166", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.noarch", "7Server-Ansible-2.6:ansible-0:2.6.1-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhsa-2019_0054
Vulnerability from csaf_redhat
Published
2019-01-16 17:11
Modified
2024-11-14 23:47
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
Security Fix(es):
* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Red Hat OpenStack Platform 10.0 (Newton).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nSecurity Fix(es):\n\n* ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs (CVE-2018-10855)\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Tobias Henkel (BMW Car IT GmbH) for reporting CVE-2018-10855 and Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2019:0054", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0054.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:47:16+00:00", generator: { date: "2024-11-14T23:47:16+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2019:0054", initial_release_date: "2019-01-16T17:11:06+00:00", revision_history: [ { date: "2019-01-16T17:11:06+00:00", number: "1", summary: "Initial version", }, { date: "2019-01-16T17:11:06+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:47:16+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 10.0", product: { name: "Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:10::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 10.0", product_id: "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-10.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2019-01-16T17:11:06+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2019:0054", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-10.0:ansible-0:2.4.6.0-1.el7ae.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
rhba-2018_3788
Vulnerability from csaf_redhat
Published
2018-12-05 19:01
Modified
2024-11-14 23:32
Summary
Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory
Notes
Topic
Updated packages that resolve various issues are now available for Red Hat
OpenStack Platform 12.0 (Pike) for RHEL 7.
Details
Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that resolve various issues are now available for Red Hat\nOpenStack Platform 12.0 (Pike) for RHEL 7.", title: "Topic", }, { category: "general", text: "Red Hat OpenStack Platform provides the facilities for building, deploying\nand monitoring a private or public infrastructure-as-a-service (IaaS) cloud\nrunning on commonly available physical hardware.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2018:3788", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { category: "external", summary: "1568591", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1568591", }, { category: "external", summary: "1644801", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1644801", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhba-2018_3788.json", }, ], title: "Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory", tracking: { current_release_date: "2024-11-14T23:32:57+00:00", generator: { date: "2024-11-14T23:32:57+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2018:3788", initial_release_date: "2018-12-05T19:01:13+00:00", revision_history: [ { date: "2018-12-05T19:01:13+00:00", number: "1", summary: "Initial version", }, { date: "2018-12-05T19:01:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:32:57+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 12.0", product: { name: "Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:12::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2152
Vulnerability from csaf_redhat
Published
2018-07-10 12:56
Modified
2024-11-14 23:43
Summary
Red Hat Security Advisory: ansible security update
Notes
Topic
An update for ansible is now available for Ansible Engine 2.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.4.6)
Security fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for ansible is now available for Ansible Engine 2.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.\n\nThe following packages have been upgraded to a newer upstream version: ansible (2.4.6)\n\nSecurity fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nThis issue was discovered by Brian Coca (Red Hat), and Michael Scherer (OSAS).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2152", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2152.json", }, ], title: "Red Hat Security Advisory: ansible security update", tracking: { current_release_date: "2024-11-14T23:43:49+00:00", generator: { date: "2024-11-14T23:43:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2152", initial_release_date: "2018-07-10T12:56:37+00:00", revision_history: [ { date: "2018-07-10T12:56:37+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-10T12:56:37+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:43:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product: { name: "Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4", product_identification_helper: { cpe: "cpe:/a:redhat:ansible_engine:2.4::el7", }, }, }, ], category: "product_family", name: "Red Hat Ansible Engine", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-doc@2.4.6.0-1.el7ae?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-Ansible-2.4", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.4 for RHEL 7 Server", product_id: "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-doc-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-Ansible-2.4", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-10T12:56:37+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2152", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-Ansible-2.4:ansible-0:2.4.6.0-1.el7ae.src", "7Server-Ansible-2.4:ansible-doc-0:2.4.6.0-1.el7ae.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHSA-2018:2321
Vulnerability from csaf_redhat
Published
2018-07-31 17:49
Modified
2024-11-14 23:44
Summary
Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
Notes
Topic
An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.
The following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)
Security Fix(es):
* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)
* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "An update for redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", title: "Topic", }, { category: "general", text: "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks.\n\nThe following packages have been upgraded to a later upstream version: imgbased (1.0.22), redhat-release-virtualization-host (4.2), redhat-virtualization-host (4.2). (BZ#1596545, BZ#1607722, BZ#1607723)\n\nSecurity Fix(es):\n\n* ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution (CVE-2018-10874)\n\n* ansible: ansible.cfg is being read from current working directory allowing possible code execution (CVE-2018-10875)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank Michael Scherer (OSAS) for reporting CVE-2018-10874. The CVE-2018-10875 issue was discovered by Brian Coca (Red Hat).", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2018:2321", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "1596545", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596545", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2321.json", }, ], title: "Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update", tracking: { current_release_date: "2024-11-14T23:44:36+00:00", generator: { date: "2024-11-14T23:44:36+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2018:2321", initial_release_date: "2018-07-31T17:49:32+00:00", revision_history: [ { date: "2018-07-31T17:49:32+00:00", number: "1", summary: "Initial version", }, { date: "2018-07-31T17:49:32+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:44:36+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product: { name: "RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, { category: "product_name", name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product: { name: "Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:7::hypervisor", }, }, }, ], category: "product_family", name: "Red Hat Virtualization", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_id: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-release-virtualization-host@4.2-5.0.el7?arch=src", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.src", product: { name: "imgbased-0:1.0.22-1.el7ev.src", product_id: "imgbased-0:1.0.22-1.el7ev.src", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=src", }, }, }, { category: "product_version", name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_id: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host@4.2-20180724.0.el7_5?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_id: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.2-5.0.el7?arch=noarch", }, }, }, { category: "product_version", name: "imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "imgbased-0:1.0.22-1.el7ev.noarch", product_id: "imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_id: "python-imgbased-0:1.0.22-1.el7ev.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/python-imgbased@1.0.22-1.el7ev?arch=noarch", }, }, }, { category: "product_version", name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_id: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.2-20180724.0.el7_5?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", }, product_reference: "redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 7", product_id: "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", }, product_reference: "redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", relates_to_product_reference: "7Server-RHEV-4-Hypervisor-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "imgbased-0:1.0.22-1.el7ev.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", }, product_reference: "imgbased-0:1.0.22-1.el7ev.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "python-imgbased-0:1.0.22-1.el7ev.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", }, product_reference: "python-imgbased-0:1.0.22-1.el7ev.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.src as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.src", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64 as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", }, product_reference: "redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, { category: "default_component_of", full_product_name: { name: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch as a component of RHEL 7-based RHEV-H for RHEV 4 (build requirements)", product_id: "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", }, product_reference: "redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", relates_to_product_reference: "7Server-RHEV-4-HypervisorBuild-7", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-07-31T17:49:32+00:00", details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", product_ids: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2018:2321", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-0:4.2-20180724.0.el7_5.src", "7Server-RHEV-4-Hypervisor-7:redhat-virtualization-host-image-update-0:4.2-20180724.0.el7_5.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:imgbased-0:1.0.22-1.el7ev.src", "7Server-RHEV-4-HypervisorBuild-7:python-imgbased-0:1.0.22-1.el7ev.noarch", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.src", "7Server-RHEV-4-HypervisorBuild-7:redhat-release-virtualization-host-0:4.2-5.0.el7.x86_64", "7Server-RHEV-4-HypervisorBuild-7:redhat-virtualization-host-image-update-placeholder-0:4.2-5.0.el7.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
RHBA-2018:3788
Vulnerability from csaf_redhat
Published
2018-12-05 19:01
Modified
2024-11-14 23:32
Summary
Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory
Notes
Topic
Updated packages that resolve various issues are now available for Red Hat
OpenStack Platform 12.0 (Pike) for RHEL 7.
Details
Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated packages that resolve various issues are now available for Red Hat\nOpenStack Platform 12.0 (Pike) for RHEL 7.", title: "Topic", }, { category: "general", text: "Red Hat OpenStack Platform provides the facilities for building, deploying\nand monitoring a private or public infrastructure-as-a-service (IaaS) cloud\nrunning on commonly available physical hardware.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHBA-2018:3788", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { category: "external", summary: "1568591", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1568591", }, { category: "external", summary: "1644801", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1644801", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhba-2018_3788.json", }, ], title: "Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 12 Bug Fix and Enhancement Advisory", tracking: { current_release_date: "2024-11-14T23:32:57+00:00", generator: { date: "2024-11-14T23:32:57+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHBA-2018:3788", initial_release_date: "2018-12-05T19:01:13+00:00", revision_history: [ { date: "2018-12-05T19:01:13+00:00", number: "1", summary: "Initial version", }, { date: "2018-12-05T19:01:13+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-14T23:32:57+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat OpenStack Platform 12.0", product: { name: "Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0", product_identification_helper: { cpe: "cpe:/a:redhat:openstack:12::el7", }, }, }, ], category: "product_family", name: "Red Hat OpenStack Platform", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.src", product: { name: "ansible-0:2.4.6.0-1.el7ae.src", product_id: "ansible-0:2.4.6.0-1.el7ae.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=src", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "ansible-0:2.4.6.0-1.el7ae.noarch", product: { name: "ansible-0:2.4.6.0-1.el7ae.noarch", product_id: "ansible-0:2.4.6.0-1.el7ae.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible@2.4.6.0-1.el7ae?arch=noarch", }, }, }, { category: "product_version", name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_id: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/ansible-role-redhat-subscription@1.0.1-4.el7ost?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-0:2.4.6.0-1.el7ae.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", }, product_reference: "ansible-0:2.4.6.0-1.el7ae.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, { category: "default_component_of", full_product_name: { name: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src as a component of Red Hat OpenStack Platform 12.0", product_id: "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", }, product_reference: "ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", relates_to_product_reference: "7Server-RH7-RHOS-12.0", }, ], }, vulnerabilities: [ { acknowledgments: [ { names: [ "Tobias Henkel", ], organization: "BMW Car IT GmbH", }, ], cve: "CVE-2018-10855", cwe: { id: "CWE-532", name: "Insertion of Sensitive Information into Log File", }, discovery_date: "2018-06-08T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1588855", }, ], notes: [ { category: "description", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "RHBZ#1588855", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1588855", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10855", url: "https://www.cve.org/CVERecord?id=CVE-2018-10855", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10855", }, { category: "external", summary: "https://github.com/ansible/ansible/pull/41414", url: "https://github.com/ansible/ansible/pull/41414", }, ], release_date: "2018-06-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "HIGH", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 5.9, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs", }, { acknowledgments: [ { names: [ "Michael Scherer", ], organization: "OSAS", }, ], cve: "CVE-2018-10874", cwe: { id: "CWE-20", name: "Improper Input Validation", }, discovery_date: "2018-06-28T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596528", }, ], notes: [ { category: "description", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "Vulnerability description", }, { category: "summary", text: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "RHBZ#1596528", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10874", url: "https://www.cve.org/CVERecord?id=CVE-2018-10874", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution", }, { acknowledgments: [ { names: [ "Brian Coca", ], organization: "Red Hat", summary: "This issue was discovered by Red Hat.", }, ], cve: "CVE-2018-10875", cwe: { id: "CWE-426", name: "Untrusted Search Path", }, discovery_date: "2018-06-29T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1596533", }, ], notes: [ { category: "description", text: "It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.", title: "Vulnerability description", }, { category: "summary", text: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", title: "Vulnerability summary", }, { category: "other", text: "Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "RHBZ#1596533", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596533", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2018-10875", url: "https://www.cve.org/CVERecord?id=CVE-2018-10875", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10875", }, ], release_date: "2018-06-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2018-12-05T19:01:13+00:00", details: "Before applying this update, ensure all previously released errata relevant\nto your system have been applied.\n\nRed Hat OpenStack Platform 12 runs on Red Hat Enterprise Linux 7.5.\n\nThe Red Hat OpenStack Platform 12 Release Notes contain the following:\n* An explanation of the way in which the provided components interact to\nform a working cloud computing environment.\n* Technology Previews, Recommended Practices, and Known Issues.\n* The channels required for Red Hat OpenStack Platform 12, including which\nchannels need to be enabled and disabled.\n\nThe Release Notes are available at:\nhttps://access.redhat.com/documentation/en-us/red_hat_openstack_platform/12/html/release_notes/\n\nThis update is available through 'yum update' on systems registered through\nRed Hat Subscription Manager. For more information about Red Hat\nSubscription Manager, see:\n\nhttps://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html", product_ids: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], scores: [ { cvss_v3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.noarch", "7Server-RH7-RHOS-12.0:ansible-0:2.4.6.0-1.el7ae.src", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.noarch", "7Server-RH7-RHOS-12.0:ansible-role-redhat-subscription-0:1.0.1-4.el7ost.src", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "ansible: ansible.cfg is being read from current working directory allowing possible code execution", }, ], }
suse-su-2024:1427-1
Vulnerability from csaf_suse
Published
2024-04-24 09:10
Modified
2024-04-24 09:10
Summary
Security Beta update for SUSE Manager Client Tools and Salt
Notes
Title of the patch
Security Beta update for SUSE Manager Client Tools and Salt
Description of the patch
This update fixes the following issues:
POS_Image-Graphical7:
- Update to version 0.1.1710765237.46af599
* Move image services to dracut-saltboot package
* Use salt bundle
- Update to version 0.1.1645440615.7f1328c
* Remove deprecated kiwi functions
POS_Image-JeOS7:
- Update to version 0.1.1710765237.46af599
* Move image services to dracut-saltboot package
* Use salt bundle
- Update to version 0.1.1645440615.7f1328c
* Remove deprecated kiwi functions
ansible:
- CVE-2023-5764: Address issues where internal templating can cause unsafe
variables to lose their unsafe designation (bsc#1216854)
* breaking_changes:
assert - Nested templating may result in an inability for the conditional
to be evaluated. See the porting guide for more information.
- CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
- CVE-2020-14365: Do a GPG validation if the disable_gpg_check option is not set. (bsc#1175993)
- Don't Require python-coverage, it is needed only for testing (bsc#1177948)
- CVE-2018-10874: Inventory variables are loaded from current working directory when running ad-hoc command that can
lead to code execution (included upstream in 2.6.1) (bsc#1099805)
dracut-saltboot:
- Update to version 0.1.1710765237.46af599
* Load only first available leaseinfo (bsc#1221092)
- Update to version 0.1.1681904360.84ef141
grafana:
- Require Go 1.20
- Update to version 9.5.16:
* [SECURITY] CVE-2023-6152: Add email verification when updating
user email (bsc#1219912)
* [BUGFIX] Annotations: Split cleanup into separate queries and
deletes to avoid deadlocks on MySQL
- Update to version 9.5.15:
* [FEATURE] Alerting: Attempt to retry retryable errors
- Update to version 9.5.14:
* [BUGFIX] Alerting: Fix state manager to not keep
datasource_uid and ref_id labels in state after Error
* [BUGFIX] Transformations: Config overrides being lost when
config from query transform is applied
* [BUGFIX] LDAP: Fix enable users on successfull login
- Update to version 9.5.13:
* [BUGFIX] BrowseDashboards: Only remember the most recent
expanded folder
* [BUGFIX] Licensing: Pass func to update env variables when
starting plugin
- Update to version 9.5.12:
* [FEATURE] Azure: Add support for Workload Identity
authentication
- Update to version 9.5.9:
* [FEATURE] SSE: Fix DSNode to not panic when response has empty
response
* [FEATURE] Prometheus: Handle the response with different field
key order
* [BUGFIX] LDAP: Fix user disabling
golang-github-prometheus-node_exporter:
- Add `device_error` label for filesystem metrics.
- Update rtnetlink library to fix errors during ARP metrics collection.
- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
* [FEATURE] Add ZFS freebsd per dataset stats #2753
* [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
* [ENHANCEMENT] Parallelize stat calls in Linux filesystem
collector #1772
* [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
* [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric
#2778
* [ENHANCEMENT] Improve qdisc collector performance #2779
* [ENHANCEMENT] Add include and exclude filter for hwmon
collector #2699
* [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead
of procfs #2777
* [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
* [BUGFIX] Fallback to 32-bit stats in netdev #2757
* [BUGFIX] Close btrfs.FS handle after use #2780
* [BUGFIX] Move RO status before error return #2807
* [BUFFIX] Fix promhttp_metric_handler_errors_total being always
active #2808
* [BUGFIX] Fix nfsd v4 index miss #2824
- Update to 1.6.1:
(no source code changes in this release)
- BuildRequire go1.20
- Update to 1.6.0:
* [CHANGE] Fix cpustat when some cpus are offline #2318
* [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
* [CHANGE] Deprecate ntp collector #2603
* [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583
* [CHANGE] Deprecate supervisord collector #2685
* [FEATURE] Enable uname collector on NetBSD #2559
* [FEATURE] NetBSD support for the meminfo collector #2570
* [FEATURE] NetBSD support for CPU collector #2626
* [FEATURE] Add FreeBSD collector for netisr subsystem #2668
* [FEATURE] Add softirqs collector #2669
* [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449
* [ENHANCEMENT] Add administrative state of Linux network
interfaces #2515
* [ENHANCEMENT] Log current value of GOMAXPROCS #2537
* [ENHANCEMENT] Add profiler options for perf collector #2542
* [ENHANCEMENT] Allow root path as metrics path #2590
* [ENHANCEMENT] Add cpu frequency governor metrics #2569
* [ENHANCEMENT] Add new landing page #2622
* [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634
* [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687
* [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats #2612
* [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669
* [BUGFIX] perf: fixes for automatically detecting the correct
tracefs mountpoints #2553
* [BUGFIX] Fix `thermal_zone` collector noise @2554
* [BUGFIX] Fix a problem fetching the user wire count on FreeBSD
2584
* [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
* [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605
* [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637
* [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in
OpenBSD #2663
- Change go_modules archive in _service to use obscpio file
spacecmd:
- Version 5.0.5-0
* Update translation strings
spacewalk-client-tools:
- Version 5.0.4-0
* Remove rhn-profile-sync rhn_register spacewalk-channel and
spacewalk-update-status
supportutils-plugin-susemanager-client:
- Version 5.0.3-0
* Remove rhnsd from client actions and server backend
uyuni-tools:
- Version 0.1.7-0
* Fix wrong Cobbler spacewalk_authentication_endpoint property after upgrade or migration
* Fix migration script using missing awk in migration image
- Version 0.1.6-0
* Pull image from authenticated registry
* Port 80 should be published to the port 80 of the containers.
8080 is squid
* Autogenerate the database password
* Add mgrctl term command
* Fix --version flag
* Deny uyuni to suma upgrade and viceversa
* Refactor upgrade to clarify script end adding post upgrade
script (bsc#1219887)
* Add mgradm install podman arguments to define big volumes storage
* k8s migration use same functions as upgrade
* Allow to use images from RPM if present
* Schedule a system list refresh after migrate if not runned before
* Ignore error on optional flag
* Fix migration of multiple autoinstallable distributions
* Obsolete uyuni-proxy-systemd-service package by mgrpxy
* Add GitHub workflow for checking changelog
* Allow installation using --image image:tag
* Add command to register Peripheral server to Hub
* Add Node exporter (9100) and Taskomatic (9800) ports to the list
of open TCP ports
* Fix minimal administrator password length
* Do not assume the current host is a cluster node when getting
kubelet version
* Add mgrpxy start, stop and restart commands
* Remove shm size constraints on the server
* Add mgrpxy and mgradm status commands
* Use uninstall commands dry run by default to avoid unintended
removals
* Make first user mandatory at install time
* Add inspect and upgrade command
* Improve error handling when exec.Command is used
* Start/Stop/Restart command with kubernetes
- Version 0.1.5-0
* Install aardvark-dns if netavark is installed (bsc#1220371)
Patchnames
SUSE-2024-1427,SUSE-SLE-Manager-Tools-15-BETA-2024-1427,SUSE-SLE-Manager-Tools-Beta-For-Micro-5-2024-1427
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security Beta update for SUSE Manager Client Tools and Salt", title: "Title of the patch", }, { category: "description", text: "This update fixes the following issues:\n\nPOS_Image-Graphical7:\n\n- Update to version 0.1.1710765237.46af599\n * Move image services to dracut-saltboot package\n * Use salt bundle\n- Update to version 0.1.1645440615.7f1328c\n * Remove deprecated kiwi functions\n\nPOS_Image-JeOS7:\n\n- Update to version 0.1.1710765237.46af599\n * Move image services to dracut-saltboot package\n * Use salt bundle\n- Update to version 0.1.1645440615.7f1328c\n * Remove deprecated kiwi functions\n\nansible:\n\n- CVE-2023-5764: Address issues where internal templating can cause unsafe\n variables to lose their unsafe designation (bsc#1216854)\n * breaking_changes:\n assert - Nested templating may result in an inability for the conditional\n to be evaluated. See the porting guide for more information.\n- CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)\n- CVE-2020-14365: Do a GPG validation if the disable_gpg_check option is not set. (bsc#1175993)\n- Don't Require python-coverage, it is needed only for testing (bsc#1177948)\n- CVE-2018-10874: Inventory variables are loaded from current working directory when running ad-hoc command that can\n lead to code execution (included upstream in 2.6.1) (bsc#1099805) \n\ndracut-saltboot:\n\n- Update to version 0.1.1710765237.46af599 \n * Load only first available leaseinfo (bsc#1221092)\n- Update to version 0.1.1681904360.84ef141\n\n\ngrafana:\n\n- Require Go 1.20\n- Update to version 9.5.16:\n * [SECURITY] CVE-2023-6152: Add email verification when updating\n user email (bsc#1219912)\n * [BUGFIX] Annotations: Split cleanup into separate queries and\n deletes to avoid deadlocks on MySQL\n- Update to version 9.5.15:\n * [FEATURE] Alerting: Attempt to retry retryable errors\n- Update to version 9.5.14:\n * [BUGFIX] Alerting: Fix state manager to not keep\n datasource_uid and ref_id labels in state after Error\n * [BUGFIX] Transformations: Config overrides being lost when\n config from query transform is applied\n * [BUGFIX] LDAP: Fix enable users on successfull login\n- Update to version 9.5.13:\n * [BUGFIX] BrowseDashboards: Only remember the most recent\n expanded folder\n * [BUGFIX] Licensing: Pass func to update env variables when\n starting plugin\n- Update to version 9.5.12:\n * [FEATURE] Azure: Add support for Workload Identity\n authentication\n- Update to version 9.5.9:\n * [FEATURE] SSE: Fix DSNode to not panic when response has empty\n response\n * [FEATURE] Prometheus: Handle the response with different field\n key order\n * [BUGFIX] LDAP: Fix user disabling\n\ngolang-github-prometheus-node_exporter:\n\n- Add `device_error` label for filesystem metrics.\n- Update rtnetlink library to fix errors during ARP metrics collection.\n- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):\n * [FEATURE] Add ZFS freebsd per dataset stats #2753\n * [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721\n * [ENHANCEMENT] Parallelize stat calls in Linux filesystem\n collector #1772\n * [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711\n * [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric\n #2778\n * [ENHANCEMENT] Improve qdisc collector performance #2779\n * [ENHANCEMENT] Add include and exclude filter for hwmon\n collector #2699\n * [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead\n of procfs #2777\n * [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754\n * [BUGFIX] Fallback to 32-bit stats in netdev #2757\n * [BUGFIX] Close btrfs.FS handle after use #2780\n * [BUGFIX] Move RO status before error return #2807\n * [BUFFIX] Fix promhttp_metric_handler_errors_total being always\n active #2808\n * [BUGFIX] Fix nfsd v4 index miss #2824\n- Update to 1.6.1:\n (no source code changes in this release)\n- BuildRequire go1.20\n- Update to 1.6.0:\n * [CHANGE] Fix cpustat when some cpus are offline #2318\n * [CHANGE] Remove metrics of offline CPUs in CPU collector #2605\n * [CHANGE] Deprecate ntp collector #2603\n * [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583\n * [CHANGE] Deprecate supervisord collector #2685\n * [FEATURE] Enable uname collector on NetBSD #2559\n * [FEATURE] NetBSD support for the meminfo collector #2570\n * [FEATURE] NetBSD support for CPU collector #2626\n * [FEATURE] Add FreeBSD collector for netisr subsystem #2668\n * [FEATURE] Add softirqs collector #2669\n * [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449\n * [ENHANCEMENT] Add administrative state of Linux network\n interfaces #2515\n * [ENHANCEMENT] Log current value of GOMAXPROCS #2537\n * [ENHANCEMENT] Add profiler options for perf collector #2542\n * [ENHANCEMENT] Allow root path as metrics path #2590\n * [ENHANCEMENT] Add cpu frequency governor metrics #2569\n * [ENHANCEMENT] Add new landing page #2622\n * [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634\n * [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687\n * [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats #2612\n * [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669\n * [BUGFIX] perf: fixes for automatically detecting the correct\n tracefs mountpoints #2553\n * [BUGFIX] Fix `thermal_zone` collector noise @2554\n * [BUGFIX] Fix a problem fetching the user wire count on FreeBSD\n 2584\n * [BUGFIX] interrupts: Fix fields on linux aarch64 #2631\n * [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605\n * [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637\n * [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in\n OpenBSD #2663\n- Change go_modules archive in _service to use obscpio file\n\nspacecmd:\n\n- Version 5.0.5-0\n * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.0.4-0\n * Remove rhn-profile-sync rhn_register spacewalk-channel and\n spacewalk-update-status\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.0.3-0\n * Remove rhnsd from client actions and server backend\n\nuyuni-tools:\n\n- Version 0.1.7-0\n * Fix wrong Cobbler spacewalk_authentication_endpoint property after upgrade or migration\n * Fix migration script using missing awk in migration image\n- Version 0.1.6-0\n * Pull image from authenticated registry\n * Port 80 should be published to the port 80 of the containers.\n 8080 is squid\n * Autogenerate the database password\n * Add mgrctl term command\n * Fix --version flag\n * Deny uyuni to suma upgrade and viceversa\n * Refactor upgrade to clarify script end adding post upgrade\n script (bsc#1219887)\n * Add mgradm install podman arguments to define big volumes storage\n * k8s migration use same functions as upgrade\n * Allow to use images from RPM if present\n * Schedule a system list refresh after migrate if not runned before\n * Ignore error on optional flag\n * Fix migration of multiple autoinstallable distributions\n * Obsolete uyuni-proxy-systemd-service package by mgrpxy\n * Add GitHub workflow for checking changelog\n * Allow installation using --image image:tag\n * Add command to register Peripheral server to Hub\n * Add Node exporter (9100) and Taskomatic (9800) ports to the list\n of open TCP ports\n * Fix minimal administrator password length\n * Do not assume the current host is a cluster node when getting\n kubelet version\n * Add mgrpxy start, stop and restart commands\n * Remove shm size constraints on the server\n * Add mgrpxy and mgradm status commands\n * Use uninstall commands dry run by default to avoid unintended\n removals\n * Make first user mandatory at install time\n * Add inspect and upgrade command\n * Improve error handling when exec.Command is used\n * Start/Stop/Restart command with kubernetes\n- Version 0.1.5-0\n * Install aardvark-dns if netavark is installed (bsc#1220371)\n\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2024-1427,SUSE-SLE-Manager-Tools-15-BETA-2024-1427,SUSE-SLE-Manager-Tools-Beta-For-Micro-5-2024-1427", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1427-1.json", }, { category: "self", summary: "URL for SUSE-SU-2024:1427-1", url: "https://www.suse.com/support/update/announcement/2024/suse-su-20241427-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2024:1427-1", url: "https://lists.suse.com/pipermail/sle-updates/2024-April/035080.html", }, { category: "self", summary: "SUSE Bug 1008037", url: "https://bugzilla.suse.com/1008037", }, { category: "self", summary: "SUSE Bug 1008038", url: "https://bugzilla.suse.com/1008038", }, { category: "self", summary: "SUSE Bug 1010940", url: "https://bugzilla.suse.com/1010940", }, { category: "self", summary: "SUSE Bug 1019021", url: "https://bugzilla.suse.com/1019021", }, { category: "self", summary: "SUSE Bug 1038785", url: "https://bugzilla.suse.com/1038785", }, { category: "self", summary: "SUSE Bug 1059235", url: "https://bugzilla.suse.com/1059235", }, { category: "self", summary: "SUSE Bug 1099805", url: "https://bugzilla.suse.com/1099805", }, { category: "self", summary: "SUSE Bug 1166389", url: "https://bugzilla.suse.com/1166389", }, { category: "self", summary: "SUSE Bug 1171823", url: "https://bugzilla.suse.com/1171823", }, { category: "self", summary: "SUSE Bug 1174145", url: "https://bugzilla.suse.com/1174145", }, { category: "self", summary: "SUSE Bug 1174302", url: "https://bugzilla.suse.com/1174302", }, { category: "self", summary: "SUSE Bug 1175993", url: "https://bugzilla.suse.com/1175993", }, { category: "self", summary: "SUSE Bug 1177948", url: "https://bugzilla.suse.com/1177948", }, { category: "self", summary: "SUSE Bug 1216854", url: "https://bugzilla.suse.com/1216854", }, { category: "self", summary: "SUSE Bug 1219002", url: "https://bugzilla.suse.com/1219002", }, { category: "self", summary: "SUSE Bug 1219887", url: "https://bugzilla.suse.com/1219887", }, { category: "self", summary: "SUSE Bug 1219912", url: "https://bugzilla.suse.com/1219912", }, { category: "self", summary: "SUSE Bug 1220371", url: "https://bugzilla.suse.com/1220371", }, { category: "self", summary: "SUSE Bug 1221092", url: "https://bugzilla.suse.com/1221092", }, { category: "self", summary: "SUSE CVE CVE-2016-8647 page", url: "https://www.suse.com/security/cve/CVE-2016-8647/", }, { category: "self", summary: "SUSE CVE CVE-2016-9587 page", url: "https://www.suse.com/security/cve/CVE-2016-9587/", }, { category: "self", summary: "SUSE CVE CVE-2017-7550 page", url: "https://www.suse.com/security/cve/CVE-2017-7550/", }, { category: "self", summary: "SUSE CVE CVE-2018-10874 page", url: "https://www.suse.com/security/cve/CVE-2018-10874/", }, { category: "self", summary: "SUSE CVE CVE-2020-14365 page", url: "https://www.suse.com/security/cve/CVE-2020-14365/", }, { category: "self", summary: "SUSE CVE CVE-2023-5764 page", url: "https://www.suse.com/security/cve/CVE-2023-5764/", }, { category: "self", summary: "SUSE CVE CVE-2023-6152 page", url: "https://www.suse.com/security/cve/CVE-2023-6152/", }, { category: "self", summary: "SUSE CVE CVE-2024-0690 page", url: "https://www.suse.com/security/cve/CVE-2024-0690/", }, ], title: "Security Beta update for SUSE Manager Client Tools and Salt", tracking: { current_release_date: "2024-04-24T09:10:16Z", generator: { date: "2024-04-24T09:10:16Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2024:1427-1", initial_release_date: "2024-04-24T09:10:16Z", revision_history: [ { date: "2024-04-24T09:10:16Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", product: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", product_id: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", }, }, { category: "product_version", name: "grafana-9.5.16-159000.4.30.2.aarch64", product: { name: "grafana-9.5.16-159000.4.30.2.aarch64", product_id: "grafana-9.5.16-159000.4.30.2.aarch64", }, }, { category: "product_version", name: "mgrctl-0.1.7-159000.3.8.1.aarch64", product: { name: "mgrctl-0.1.7-159000.3.8.1.aarch64", product_id: "mgrctl-0.1.7-159000.3.8.1.aarch64", }, }, { category: "product_version", name: "uyuni-base-common-5.0.2-159000.3.21.2.aarch64", product: { name: "uyuni-base-common-5.0.2-159000.3.21.2.aarch64", product_id: "uyuni-base-common-5.0.2-159000.3.21.2.aarch64", }, }, { category: "product_version", name: "uyuni-base-proxy-5.0.2-159000.3.21.2.aarch64", product: { name: "uyuni-base-proxy-5.0.2-159000.3.21.2.aarch64", product_id: "uyuni-base-proxy-5.0.2-159000.3.21.2.aarch64", }, }, { category: "product_version", name: "uyuni-base-server-5.0.2-159000.3.21.2.aarch64", product: { name: "uyuni-base-server-5.0.2-159000.3.21.2.aarch64", product_id: "uyuni-base-server-5.0.2-159000.3.21.2.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", product: { name: "POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", product_id: "POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", }, }, { category: "product_version", name: "POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", product: { name: "POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", product_id: "POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", }, }, { category: "product_version", name: "ansible-2.9.27-159000.3.12.2.noarch", product: { name: "ansible-2.9.27-159000.3.12.2.noarch", product_id: "ansible-2.9.27-159000.3.12.2.noarch", }, }, { category: "product_version", name: "ansible-doc-2.9.27-159000.3.12.2.noarch", product: { name: "ansible-doc-2.9.27-159000.3.12.2.noarch", product_id: "ansible-doc-2.9.27-159000.3.12.2.noarch", }, }, { category: "product_version", name: "ansible-test-2.9.27-159000.3.12.2.noarch", product: { name: "ansible-test-2.9.27-159000.3.12.2.noarch", product_id: "ansible-test-2.9.27-159000.3.12.2.noarch", }, }, { category: "product_version", name: "dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", product: { name: "dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", product_id: "dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", }, }, { category: "product_version", name: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", product: { name: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", product_id: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", }, }, { category: "product_version", name: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", product: { name: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", product_id: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", }, }, { category: "product_version", name: "python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", product: { name: "python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", product_id: "python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", product: { name: "python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", product_id: "python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", product: { name: "python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", product_id: "python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "spacecmd-5.0.5-159000.6.48.2.noarch", product: { name: "spacecmd-5.0.5-159000.6.48.2.noarch", product_id: "spacecmd-5.0.5-159000.6.48.2.noarch", }, }, { category: "product_version", name: "spacewalk-check-5.0.4-159000.6.54.2.noarch", product: { name: "spacewalk-check-5.0.4-159000.6.54.2.noarch", product_id: "spacewalk-check-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", product: { name: "spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", product_id: "spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", product: { name: "spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", product_id: "spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", }, }, { category: "product_version", name: "supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", product: { name: "supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", product_id: "supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.ppc64le", product: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.ppc64le", product_id: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.ppc64le", }, }, { category: "product_version", name: "grafana-9.5.16-159000.4.30.2.ppc64le", product: { name: "grafana-9.5.16-159000.4.30.2.ppc64le", product_id: "grafana-9.5.16-159000.4.30.2.ppc64le", }, }, { category: "product_version", name: "mgrctl-0.1.7-159000.3.8.1.ppc64le", product: { name: "mgrctl-0.1.7-159000.3.8.1.ppc64le", product_id: "mgrctl-0.1.7-159000.3.8.1.ppc64le", }, }, { category: "product_version", name: "uyuni-base-common-5.0.2-159000.3.21.2.ppc64le", product: { name: "uyuni-base-common-5.0.2-159000.3.21.2.ppc64le", product_id: "uyuni-base-common-5.0.2-159000.3.21.2.ppc64le", }, }, { category: "product_version", name: "uyuni-base-proxy-5.0.2-159000.3.21.2.ppc64le", product: { name: "uyuni-base-proxy-5.0.2-159000.3.21.2.ppc64le", product_id: "uyuni-base-proxy-5.0.2-159000.3.21.2.ppc64le", }, }, { category: "product_version", name: "uyuni-base-server-5.0.2-159000.3.21.2.ppc64le", product: { name: "uyuni-base-server-5.0.2-159000.3.21.2.ppc64le", product_id: "uyuni-base-server-5.0.2-159000.3.21.2.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", product: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", product_id: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", }, }, { category: "product_version", name: "grafana-9.5.16-159000.4.30.2.s390x", product: { name: "grafana-9.5.16-159000.4.30.2.s390x", product_id: "grafana-9.5.16-159000.4.30.2.s390x", }, }, { category: "product_version", name: "mgrctl-0.1.7-159000.3.8.1.s390x", product: { name: "mgrctl-0.1.7-159000.3.8.1.s390x", product_id: "mgrctl-0.1.7-159000.3.8.1.s390x", }, }, { category: "product_version", name: "uyuni-base-common-5.0.2-159000.3.21.2.s390x", product: { name: "uyuni-base-common-5.0.2-159000.3.21.2.s390x", product_id: "uyuni-base-common-5.0.2-159000.3.21.2.s390x", }, }, { category: "product_version", name: "uyuni-base-proxy-5.0.2-159000.3.21.2.s390x", product: { name: "uyuni-base-proxy-5.0.2-159000.3.21.2.s390x", product_id: "uyuni-base-proxy-5.0.2-159000.3.21.2.s390x", }, }, { category: "product_version", name: "uyuni-base-server-5.0.2-159000.3.21.2.s390x", product: { name: "uyuni-base-server-5.0.2-159000.3.21.2.s390x", product_id: "uyuni-base-server-5.0.2-159000.3.21.2.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", product: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", product_id: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", }, }, { category: "product_version", name: "grafana-9.5.16-159000.4.30.2.x86_64", product: { name: "grafana-9.5.16-159000.4.30.2.x86_64", product_id: "grafana-9.5.16-159000.4.30.2.x86_64", }, }, { category: "product_version", name: "mgrctl-0.1.7-159000.3.8.1.x86_64", product: { name: "mgrctl-0.1.7-159000.3.8.1.x86_64", product_id: "mgrctl-0.1.7-159000.3.8.1.x86_64", }, }, { category: "product_version", name: "uyuni-base-common-5.0.2-159000.3.21.2.x86_64", product: { name: "uyuni-base-common-5.0.2-159000.3.21.2.x86_64", product_id: "uyuni-base-common-5.0.2-159000.3.21.2.x86_64", }, }, { category: "product_version", name: "uyuni-base-proxy-5.0.2-159000.3.21.2.x86_64", product: { name: "uyuni-base-proxy-5.0.2-159000.3.21.2.x86_64", product_id: "uyuni-base-proxy-5.0.2-159000.3.21.2.x86_64", }, }, { category: "product_version", name: "uyuni-base-server-5.0.2-159000.3.21.2.x86_64", product: { name: "uyuni-base-server-5.0.2-159000.3.21.2.x86_64", product_id: "uyuni-base-server-5.0.2-159000.3.21.2.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Manager Client Tools 15-BETA", product: { name: "SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA", }, }, { category: "product_name", name: "SUSE Manager Client Tools Beta for SLE Micro 5", product: { name: "SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5", product_identification_helper: { cpe: "cpe:/o:suse:sle-manager-tools-beta-micro:5", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", }, product_reference: "POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", }, product_reference: "POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "ansible-2.9.27-159000.3.12.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", }, product_reference: "ansible-2.9.27-159000.3.12.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-2.9.27-159000.3.12.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", }, product_reference: "ansible-doc-2.9.27-159000.3.12.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", }, product_reference: "dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.16-159000.4.30.2.aarch64 as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", }, product_reference: "grafana-9.5.16-159000.4.30.2.aarch64", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.16-159000.4.30.2.ppc64le as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", }, product_reference: "grafana-9.5.16-159000.4.30.2.ppc64le", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.16-159000.4.30.2.s390x as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", }, product_reference: "grafana-9.5.16-159000.4.30.2.s390x", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.16-159000.4.30.2.x86_64 as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", }, product_reference: "grafana-9.5.16-159000.4.30.2.x86_64", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.aarch64 as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.aarch64", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.ppc64le as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.ppc64le", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.s390x as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.s390x", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.x86_64 as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.x86_64", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", }, product_reference: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", }, product_reference: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-check-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", }, product_reference: "python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", }, product_reference: "python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", }, product_reference: "python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "spacecmd-5.0.5-159000.6.48.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", }, product_reference: "spacecmd-5.0.5-159000.6.48.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "spacewalk-check-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", }, product_reference: "spacewalk-check-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "spacewalk-client-setup-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", }, product_reference: "spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "spacewalk-client-tools-5.0.4-159000.6.54.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", }, product_reference: "spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch as component of SUSE Manager Client Tools 15-BETA", product_id: "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", }, product_reference: "supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15-BETA", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64 as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", }, product_reference: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", }, product_reference: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64 as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", }, product_reference: "golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.aarch64 as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.aarch64", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.s390x as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.s390x", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "mgrctl-0.1.7-159000.3.8.1.x86_64 as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", }, product_reference: "mgrctl-0.1.7-159000.3.8.1.x86_64", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", }, product_reference: "mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch as component of SUSE Manager Client Tools Beta for SLE Micro 5", product_id: "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", }, product_reference: "mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", relates_to_product_reference: "SUSE Manager Client Tools Beta for SLE Micro 5", }, ], }, vulnerabilities: [ { cve: "CVE-2016-8647", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8647", }, ], notes: [ { category: "general", text: "An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-8647", url: "https://www.suse.com/security/cve/CVE-2016-8647", }, { category: "external", summary: "SUSE Bug 1008038 for CVE-2016-8647", url: "https://bugzilla.suse.com/1008038", }, { category: "external", summary: "SUSE Bug 1010940 for CVE-2016-8647", url: "https://bugzilla.suse.com/1010940", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 4.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "low", }, ], title: "CVE-2016-8647", }, { cve: "CVE-2016-9587", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-9587", }, ], notes: [ { category: "general", text: "Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-9587", url: "https://www.suse.com/security/cve/CVE-2016-9587", }, { category: "external", summary: "SUSE Bug 1019021 for CVE-2016-9587", url: "https://bugzilla.suse.com/1019021", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "important", }, ], title: "CVE-2016-9587", }, { cve: "CVE-2017-7550", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-7550", }, ], notes: [ { category: "general", text: "A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2017-7550", url: "https://www.suse.com/security/cve/CVE-2017-7550", }, { category: "external", summary: "SUSE Bug 1035124 for CVE-2017-7550", url: "https://bugzilla.suse.com/1035124", }, { category: "external", summary: "SUSE Bug 1065872 for CVE-2017-7550", url: "https://bugzilla.suse.com/1065872", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 8.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "important", }, ], title: "CVE-2017-7550", }, { cve: "CVE-2018-10874", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-10874", }, ], notes: [ { category: "general", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2018-10874", url: "https://www.suse.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "SUSE Bug 1097775 for CVE-2018-10874", url: "https://bugzilla.suse.com/1097775", }, { category: "external", summary: "SUSE Bug 1099805 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099805", }, { category: "external", summary: "SUSE Bug 1099808 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099808", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "important", }, ], title: "CVE-2018-10874", }, { cve: "CVE-2020-14365", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-14365", }, ], notes: [ { category: "general", text: "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-14365", url: "https://www.suse.com/security/cve/CVE-2020-14365", }, { category: "external", summary: "SUSE Bug 1175993 for CVE-2020-14365", url: "https://bugzilla.suse.com/1175993", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "moderate", }, ], title: "CVE-2020-14365", }, { cve: "CVE-2023-5764", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-5764", }, ], notes: [ { category: "general", text: "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2023-5764", url: "https://www.suse.com/security/cve/CVE-2023-5764", }, { category: "external", summary: "SUSE Bug 1216854 for CVE-2023-5764", url: "https://bugzilla.suse.com/1216854", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "moderate", }, ], title: "CVE-2023-5764", }, { cve: "CVE-2023-6152", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-6152", }, ], notes: [ { category: "general", text: "A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2023-6152", url: "https://www.suse.com/security/cve/CVE-2023-6152", }, { category: "external", summary: "SUSE Bug 1219912 for CVE-2023-6152", url: "https://bugzilla.suse.com/1219912", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "moderate", }, ], title: "CVE-2023-6152", }, { cve: "CVE-2024-0690", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-0690", }, ], notes: [ { category: "general", text: "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2024-0690", url: "https://www.suse.com/security/cve/CVE-2024-0690", }, { category: "external", summary: "SUSE Bug 1219002 for CVE-2024-0690", url: "https://bugzilla.suse.com/1219002", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Manager Client Tools 15-BETA:POS_Image-Graphical7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:POS_Image-JeOS7-0.1.1710765237.46af599-159000.3.24.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:ansible-doc-2.9.27-159000.3.12.2.noarch", "SUSE Manager Client Tools 15-BETA:dracut-saltboot-0.1.1710765237.46af599-159000.3.33.2.noarch", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.aarch64", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.ppc64le", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.s390x", "SUSE Manager Client Tools 15-BETA:grafana-9.5.16-159000.4.30.2.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.ppc64le", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools 15-BETA:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools 15-BETA:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:python3-spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacecmd-5.0.5-159000.6.48.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-check-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-setup-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:spacewalk-client-tools-5.0.4-159000.6.54.2.noarch", "SUSE Manager Client Tools 15-BETA:supportutils-plugin-susemanager-client-5.0.3-159000.6.21.2.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:golang-github-prometheus-node_exporter-1.5.0-159000.6.2.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.aarch64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.s390x", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-0.1.7-159000.3.8.1.x86_64", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-bash-completion-0.1.7-159000.3.8.1.noarch", "SUSE Manager Client Tools Beta for SLE Micro 5:mgrctl-zsh-completion-0.1.7-159000.3.8.1.noarch", ], }, ], threats: [ { category: "impact", date: "2024-04-24T09:10:16Z", details: "moderate", }, ], title: "CVE-2024-0690", }, ], }
suse-su-2018:4130-1
Vulnerability from csaf_suse
Published
2018-12-14 15:12
Modified
2018-12-14 15:12
Summary
Security update for ansible
Notes
Title of the patch
Security update for ansible
Description of the patch
This update for ansible fixes the following issues:
Ansible was updated to ansible 2.4.6.0.
The full release notes can be found on:
https://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md
Security issues fixed:
- CVE-2018-10875: ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. (bsc#1099808)
- CVE-2018-10874: It was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result. (bsc#1099805)
- CVE-2018-10855: Ansible did not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. (bsc#1097775)
Patchnames
HPE-Helion-OpenStack-8-2018-2943,SUSE-OpenStack-Cloud-8-2018-2943,SUSE-OpenStack-Cloud-Crowbar-8-2018-2943
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for ansible", title: "Title of the patch", }, { category: "description", text: "This update for ansible fixes the following issues:\n\nAnsible was updated to ansible 2.4.6.0.\n\nThe full release notes can be found on:\n\n\thttps://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md\n\nSecurity issues fixed:\n\n- CVE-2018-10875: ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. (bsc#1099808)\n- CVE-2018-10874: It was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result. (bsc#1099805)\n- CVE-2018-10855: Ansible did not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. (bsc#1097775)\n", title: "Description of the patch", }, { category: "details", text: "HPE-Helion-OpenStack-8-2018-2943,SUSE-OpenStack-Cloud-8-2018-2943,SUSE-OpenStack-Cloud-Crowbar-8-2018-2943", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_4130-1.json", }, { category: "self", summary: "URL for SUSE-SU-2018:4130-1", url: "https://www.suse.com/support/update/announcement/2018/suse-su-20184130-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2018:4130-1", url: "https://lists.suse.com/pipermail/sle-security-updates/2018-December/004967.html", }, { category: "self", summary: "SUSE Bug 1097775", url: "https://bugzilla.suse.com/1097775", }, { category: "self", summary: "SUSE Bug 1099805", url: "https://bugzilla.suse.com/1099805", }, { category: "self", summary: "SUSE Bug 1099808", url: "https://bugzilla.suse.com/1099808", }, { category: "self", summary: "SUSE CVE CVE-2018-10855 page", url: "https://www.suse.com/security/cve/CVE-2018-10855/", }, { category: "self", summary: "SUSE CVE CVE-2018-10874 page", url: "https://www.suse.com/security/cve/CVE-2018-10874/", }, { category: "self", summary: "SUSE CVE CVE-2018-10875 page", url: "https://www.suse.com/security/cve/CVE-2018-10875/", }, ], title: "Security update for ansible", tracking: { current_release_date: "2018-12-14T15:12:26Z", generator: { date: "2018-12-14T15:12:26Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2018:4130-1", initial_release_date: "2018-12-14T15:12:26Z", revision_history: [ { date: "2018-12-14T15:12:26Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "ansible-2.4.6.0-3.3.1.noarch", product: { name: "ansible-2.4.6.0-3.3.1.noarch", product_id: "ansible-2.4.6.0-3.3.1.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_name", name: "HPE Helion OpenStack 8", product: { name: "HPE Helion OpenStack 8", product_id: "HPE Helion OpenStack 8", product_identification_helper: { cpe: "cpe:/o:suse:hpe-helion-openstack:8", }, }, }, { category: "product_name", name: "SUSE OpenStack Cloud 8", product: { name: "SUSE OpenStack Cloud 8", product_id: "SUSE OpenStack Cloud 8", product_identification_helper: { cpe: "cpe:/o:suse:suse-openstack-cloud:8", }, }, }, { category: "product_name", name: "SUSE OpenStack Cloud Crowbar 8", product: { name: "SUSE OpenStack Cloud Crowbar 8", product_id: "SUSE OpenStack Cloud Crowbar 8", product_identification_helper: { cpe: "cpe:/o:suse:suse-openstack-cloud-crowbar:8", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "ansible-2.4.6.0-3.3.1.noarch as component of HPE Helion OpenStack 8", product_id: "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", }, product_reference: "ansible-2.4.6.0-3.3.1.noarch", relates_to_product_reference: "HPE Helion OpenStack 8", }, { category: "default_component_of", full_product_name: { name: "ansible-2.4.6.0-3.3.1.noarch as component of SUSE OpenStack Cloud 8", product_id: "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", }, product_reference: "ansible-2.4.6.0-3.3.1.noarch", relates_to_product_reference: "SUSE OpenStack Cloud 8", }, { category: "default_component_of", full_product_name: { name: "ansible-2.4.6.0-3.3.1.noarch as component of SUSE OpenStack Cloud Crowbar 8", product_id: "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", }, product_reference: "ansible-2.4.6.0-3.3.1.noarch", relates_to_product_reference: "SUSE OpenStack Cloud Crowbar 8", }, ], }, vulnerabilities: [ { cve: "CVE-2018-10855", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-10855", }, ], notes: [ { category: "general", text: "Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.", title: "CVE description", }, ], product_status: { recommended: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2018-10855", url: "https://www.suse.com/security/cve/CVE-2018-10855", }, { category: "external", summary: "SUSE Bug 1097775 for CVE-2018-10855", url: "https://bugzilla.suse.com/1097775", }, { category: "external", summary: "SUSE Bug 1099808 for CVE-2018-10855", url: "https://bugzilla.suse.com/1099808", }, { category: "external", summary: "SUSE Bug 1109957 for CVE-2018-10855", url: "https://bugzilla.suse.com/1109957", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", version: "3.0", }, products: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], threats: [ { category: "impact", date: "2018-12-14T15:12:26Z", details: "moderate", }, ], title: "CVE-2018-10855", }, { cve: "CVE-2018-10874", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-10874", }, ], notes: [ { category: "general", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "CVE description", }, ], product_status: { recommended: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2018-10874", url: "https://www.suse.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "SUSE Bug 1097775 for CVE-2018-10874", url: "https://bugzilla.suse.com/1097775", }, { category: "external", summary: "SUSE Bug 1099805 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099805", }, { category: "external", summary: "SUSE Bug 1099808 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099808", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], threats: [ { category: "impact", date: "2018-12-14T15:12:26Z", details: "important", }, ], title: "CVE-2018-10874", }, { cve: "CVE-2018-10875", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-10875", }, ], notes: [ { category: "general", text: "A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.", title: "CVE description", }, ], product_status: { recommended: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, references: [ { category: "external", summary: "CVE-2018-10875", url: "https://www.suse.com/security/cve/CVE-2018-10875", }, { category: "external", summary: "SUSE Bug 1099808 for CVE-2018-10875", url: "https://bugzilla.suse.com/1099808", }, { category: "external", summary: "SUSE Bug 1109957 for CVE-2018-10875", url: "https://bugzilla.suse.com/1109957", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "HPE Helion OpenStack 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.3.1.noarch", "SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.3.1.noarch", ], }, ], threats: [ { category: "impact", date: "2018-12-14T15:12:26Z", details: "important", }, ], title: "CVE-2018-10875", }, ], }
suse-su-2024:1509-1
Vulnerability from csaf_suse
Published
2024-05-06 09:47
Modified
2024-05-06 09:47
Summary
Security update for SUSE Manager Client Tools
Notes
Title of the patch
Security update for SUSE Manager Client Tools
Description of the patch
This update fixes the following issues:
POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:
- Version 0.1.1710765237.46af599
* Moved image services to dracut-saltboot package
* Use salt bundle
- Version 0.1.1645440615.7f1328c
* Removed deprecated kiwi functions
POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:
- Version 0.1.1710765237.46af599
* Moved image services to dracut-saltboot package
* Use salt bundle
- Version 0.1.1645440615.7f1328c
* Removed deprecated kiwi functions
ansible received the following fixes:
- Security issues fixed:
* CVE-2023-5764: Address issues where internal templating can cause unsafe
variables to lose their unsafe designation (bsc#1216854)
+ Breaking changes:
assert - Nested templating may result in an inability for the conditional
to be evaluated. See the porting guide for more information.
* CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
* CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)
* CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)
* CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that
can lead to code execution (bsc#1099805)
- Bugs fixed:
* Don't Require python-coverage, it is needed only for testing (bsc#1177948)
dracut-saltboot was updated to version 0.1.1710765237.46af599:
- Version 0.1.1710765237.46af599
* Load only first available leaseinfo (bsc#1221092)
- Version 0.1.1681904360.84ef141
grafana was updated to version 9.5.18:
- Grafana now requires Go 1.20
- Security issues fixed:
* CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
* CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
- Other non-security related changes:
* Version 9.5.17:
+ [FEATURE] Alerting: Backport use Alertmanager API v2
* Version 9.5.16:
+ [BUGFIX] Annotations: Split cleanup into separate queries and
deletes to avoid deadlocks on MySQL
* Version 9.5.15:
+ [FEATURE] Alerting: Attempt to retry retryable errors
* Version 9.5.14:
+ [BUGFIX] Alerting: Fix state manager to not keep
datasource_uid and ref_id labels in state after Error
+ [BUGFIX] Transformations: Config overrides being lost when
config from query transform is applied
+ [BUGFIX] LDAP: Fix enable users on successfull login
* Version 9.5.13:
+ [BUGFIX] BrowseDashboards: Only remember the most recent
expanded folder
+ [BUGFIX] Licensing: Pass func to update env variables when
starting plugin
* Version 9.5.12:
+ [FEATURE] Azure: Add support for Workload Identity
authentication
* Version 9.5.9:
+ [FEATURE] SSE: Fix DSNode to not panic when response has empty
response
+ [FEATURE] Prometheus: Handle the response with different field
key order
+ [BUGFIX] LDAP: Fix user disabling
mgr-daemon was updated to version 4.3.9-0:
- Version 4.3.9-0
* Update translation strings
spacecmd was updated to version 4.3.27-0:
- Version 4.3.27-0
* Update translation strings
spacewalk-client-tools was updated to version 4.3.19-0:
- Version 4.3.19-0
* Update translation strings
spacewalk-koan was updated to version version 4.3.6-0:
- Version 4.3.6-0
* Change Docker image location for test
uyuni-common-libs was updated to version 4.3.10-0:
- Version 4.3.10-0
* Add support for package signature type V4 RSA/SHA384
* Add support for package signature type V4 RSA/SHA512 (bsc#1221465)
uyuni-proxy-systemd-services was updated to version 4.3.12-0:
- Version 4.3.12-0
* Update to SUSE Manager 4.3.12
Patchnames
SUSE-2024-1509,SUSE-SLE-Manager-Tools-15-2024-1509,SUSE-SLE-Manager-Tools-For-Micro-5-2024-1509,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1509,SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-1509,openSUSE-SLE-15.5-2024-1509
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Security update for SUSE Manager Client Tools", title: "Title of the patch", }, { category: "description", text: "This update fixes the following issues:\n\nPOS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n * Moved image services to dracut-saltboot package\n * Use salt bundle\n\n- Version 0.1.1645440615.7f1328c\n\n * Removed deprecated kiwi functions\n\nPOS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n * Moved image services to dracut-saltboot package\n * Use salt bundle\n\n- Version 0.1.1645440615.7f1328c\n\n * Removed deprecated kiwi functions\n\nansible received the following fixes:\n\n- Security issues fixed:\n\n * CVE-2023-5764: Address issues where internal templating can cause unsafe\n variables to lose their unsafe designation (bsc#1216854)\n\n + Breaking changes:\n assert - Nested templating may result in an inability for the conditional\n to be evaluated. See the porting guide for more information.\n\n * CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)\n * CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)\n * CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)\n * CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that\n can lead to code execution (bsc#1099805)\n\n- Bugs fixed: \n\n * Don't Require python-coverage, it is needed only for testing (bsc#1177948)\n\ndracut-saltboot was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n * Load only first available leaseinfo (bsc#1221092)\n\n- Version 0.1.1681904360.84ef141\n\ngrafana was updated to version 9.5.18:\n\n- Grafana now requires Go 1.20\n- Security issues fixed:\n\n * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)\n * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n\n- Other non-security related changes:\n\n * Version 9.5.17:\n\n + [FEATURE] Alerting: Backport use Alertmanager API v2\n\n * Version 9.5.16:\n\n + [BUGFIX] Annotations: Split cleanup into separate queries and\n deletes to avoid deadlocks on MySQL\n\n * Version 9.5.15:\n\n + [FEATURE] Alerting: Attempt to retry retryable errors\n\n * Version 9.5.14:\n\n + [BUGFIX] Alerting: Fix state manager to not keep\n datasource_uid and ref_id labels in state after Error\n + [BUGFIX] Transformations: Config overrides being lost when\n config from query transform is applied\n + [BUGFIX] LDAP: Fix enable users on successfull login\n\n * Version 9.5.13:\n\n + [BUGFIX] BrowseDashboards: Only remember the most recent\n expanded folder\n + [BUGFIX] Licensing: Pass func to update env variables when\n starting plugin\n\n * Version 9.5.12:\n\n + [FEATURE] Azure: Add support for Workload Identity\n authentication\n\n * Version 9.5.9:\n\n + [FEATURE] SSE: Fix DSNode to not panic when response has empty\n response\n + [FEATURE] Prometheus: Handle the response with different field\n key order\n + [BUGFIX] LDAP: Fix user disabling\n\nmgr-daemon was updated to version 4.3.9-0:\n\n- Version 4.3.9-0\n\n * Update translation strings\n\nspacecmd was updated to version 4.3.27-0:\n\n- Version 4.3.27-0\n\n * Update translation strings\n\nspacewalk-client-tools was updated to version 4.3.19-0:\n\n- Version 4.3.19-0\n\n * Update translation strings\n\nspacewalk-koan was updated to version version 4.3.6-0:\n\n- Version 4.3.6-0\n\n * Change Docker image location for test\n\nuyuni-common-libs was updated to version 4.3.10-0:\n\n- Version 4.3.10-0\n\n * Add support for package signature type V4 RSA/SHA384\n * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)\n\nuyuni-proxy-systemd-services was updated to version 4.3.12-0:\n\n- Version 4.3.12-0\n\n * Update to SUSE Manager 4.3.12\n", title: "Description of the patch", }, { category: "details", text: "SUSE-2024-1509,SUSE-SLE-Manager-Tools-15-2024-1509,SUSE-SLE-Manager-Tools-For-Micro-5-2024-1509,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1509,SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-1509,openSUSE-SLE-15.5-2024-1509", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_1509-1.json", }, { category: "self", summary: "URL for SUSE-SU-2024:1509-1", url: "https://www.suse.com/support/update/announcement/2024/suse-su-20241509-1/", }, { category: "self", summary: "E-Mail link for SUSE-SU-2024:1509-1", url: "https://lists.suse.com/pipermail/sle-updates/2024-May/035168.html", }, { category: "self", summary: "SUSE Bug 1008037", url: "https://bugzilla.suse.com/1008037", }, { category: "self", summary: "SUSE Bug 1008038", url: "https://bugzilla.suse.com/1008038", }, { category: "self", summary: "SUSE Bug 1010940", url: "https://bugzilla.suse.com/1010940", }, { category: "self", summary: "SUSE Bug 1019021", url: "https://bugzilla.suse.com/1019021", }, { category: "self", summary: "SUSE Bug 1038785", url: "https://bugzilla.suse.com/1038785", }, { category: "self", summary: "SUSE Bug 1059235", url: "https://bugzilla.suse.com/1059235", }, { category: "self", summary: "SUSE Bug 1099805", url: "https://bugzilla.suse.com/1099805", }, { category: "self", summary: "SUSE Bug 1166389", url: "https://bugzilla.suse.com/1166389", }, { category: "self", summary: "SUSE Bug 1171823", url: "https://bugzilla.suse.com/1171823", }, { category: "self", summary: "SUSE Bug 1174145", url: "https://bugzilla.suse.com/1174145", }, { category: "self", summary: "SUSE Bug 1174302", url: "https://bugzilla.suse.com/1174302", }, { category: "self", summary: "SUSE Bug 1175993", url: "https://bugzilla.suse.com/1175993", }, { category: "self", summary: "SUSE Bug 1177948", url: "https://bugzilla.suse.com/1177948", }, { category: "self", summary: "SUSE Bug 1216854", url: "https://bugzilla.suse.com/1216854", }, { category: "self", summary: "SUSE Bug 1219002", url: "https://bugzilla.suse.com/1219002", }, { category: "self", summary: "SUSE Bug 1219912", url: "https://bugzilla.suse.com/1219912", }, { category: "self", summary: "SUSE Bug 1221092", url: "https://bugzilla.suse.com/1221092", }, { category: "self", summary: "SUSE Bug 1221465", url: "https://bugzilla.suse.com/1221465", }, { category: "self", summary: "SUSE Bug 1222155", url: "https://bugzilla.suse.com/1222155", }, { category: "self", summary: "SUSE CVE CVE-2016-8614 page", url: "https://www.suse.com/security/cve/CVE-2016-8614/", }, { category: "self", summary: "SUSE CVE CVE-2016-8628 page", url: "https://www.suse.com/security/cve/CVE-2016-8628/", }, { category: "self", summary: "SUSE CVE CVE-2016-8647 page", url: "https://www.suse.com/security/cve/CVE-2016-8647/", }, { category: "self", summary: "SUSE CVE CVE-2016-9587 page", url: "https://www.suse.com/security/cve/CVE-2016-9587/", }, { category: "self", summary: "SUSE CVE CVE-2017-7550 page", url: "https://www.suse.com/security/cve/CVE-2017-7550/", }, { category: "self", summary: "SUSE CVE CVE-2018-10874 page", url: "https://www.suse.com/security/cve/CVE-2018-10874/", }, { category: "self", summary: "SUSE CVE CVE-2020-10744 page", url: "https://www.suse.com/security/cve/CVE-2020-10744/", }, { category: "self", summary: "SUSE CVE CVE-2020-14330 page", url: "https://www.suse.com/security/cve/CVE-2020-14330/", }, { category: "self", summary: "SUSE CVE CVE-2020-14332 page", url: "https://www.suse.com/security/cve/CVE-2020-14332/", }, { category: "self", summary: "SUSE CVE CVE-2020-14365 page", url: "https://www.suse.com/security/cve/CVE-2020-14365/", }, { category: "self", summary: "SUSE CVE CVE-2020-1753 page", url: "https://www.suse.com/security/cve/CVE-2020-1753/", }, { category: "self", summary: "SUSE CVE CVE-2023-5764 page", url: "https://www.suse.com/security/cve/CVE-2023-5764/", }, { category: "self", summary: "SUSE CVE CVE-2023-6152 page", url: "https://www.suse.com/security/cve/CVE-2023-6152/", }, { category: "self", summary: "SUSE CVE CVE-2024-0690 page", url: "https://www.suse.com/security/cve/CVE-2024-0690/", }, { category: "self", summary: "SUSE CVE CVE-2024-1313 page", url: "https://www.suse.com/security/cve/CVE-2024-1313/", }, ], title: "Security update for SUSE Manager Client Tools", tracking: { current_release_date: "2024-05-06T09:47:44Z", generator: { date: "2024-05-06T09:47:44Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "SUSE-SU-2024:1509-1", initial_release_date: "2024-05-06T09:47:44Z", revision_history: [ { date: "2024-05-06T09:47:44Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", product: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", product_id: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", }, }, { category: "product_version", name: "grafana-9.5.18-150000.1.63.2.aarch64", product: { name: "grafana-9.5.18-150000.1.63.2.aarch64", product_id: "grafana-9.5.18-150000.1.63.2.aarch64", }, }, { category: "product_version", name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", product: { name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", product_id: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", }, }, { category: "product_version", name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", product: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", product_id: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.i586", product: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.i586", product_id: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.i586", }, }, { category: "product_version", name: "grafana-9.5.18-150000.1.63.2.i586", product: { name: "grafana-9.5.18-150000.1.63.2.i586", product_id: "grafana-9.5.18-150000.1.63.2.i586", }, }, { category: "product_version", name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.i586", product: { name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.i586", product_id: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.i586", }, }, { category: "product_version", name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.i586", product: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.i586", product_id: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.i586", }, }, ], category: "architecture", name: "i586", }, { branches: [ { category: "product_version", name: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", product: { name: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", product_id: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, }, { category: "product_version", name: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", product: { name: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", product_id: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, }, { category: "product_version", name: "ansible-2.9.27-150000.1.17.2.noarch", product: { name: "ansible-2.9.27-150000.1.17.2.noarch", product_id: "ansible-2.9.27-150000.1.17.2.noarch", }, }, { category: "product_version", name: "ansible-doc-2.9.27-150000.1.17.2.noarch", product: { name: "ansible-doc-2.9.27-150000.1.17.2.noarch", product_id: "ansible-doc-2.9.27-150000.1.17.2.noarch", }, }, { category: "product_version", name: "ansible-test-2.9.27-150000.1.17.2.noarch", product: { name: "ansible-test-2.9.27-150000.1.17.2.noarch", product_id: "ansible-test-2.9.27-150000.1.17.2.noarch", }, }, { category: "product_version", name: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", product: { name: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", product_id: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", }, }, { category: "product_version", name: "mgr-daemon-4.3.9-150000.1.47.2.noarch", product: { name: "mgr-daemon-4.3.9-150000.1.47.2.noarch", product_id: "mgr-daemon-4.3.9-150000.1.47.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", product: { name: "python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", product_id: "python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", product: { name: "python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", product_id: "python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", product: { name: "python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", product_id: "python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", product: { name: "python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", product_id: "python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", }, }, { category: "product_version", name: "spacecmd-4.3.27-150000.3.116.2.noarch", product: { name: "spacecmd-4.3.27-150000.3.116.2.noarch", product_id: "spacecmd-4.3.27-150000.3.116.2.noarch", }, }, { category: "product_version", name: "spacewalk-check-4.3.19-150000.3.89.2.noarch", product: { name: "spacewalk-check-4.3.19-150000.3.89.2.noarch", product_id: "spacewalk-check-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", product: { name: "spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", product_id: "spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", product: { name: "spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", product_id: "spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", }, }, { category: "product_version", name: "spacewalk-koan-4.3.6-150000.3.33.2.noarch", product: { name: "spacewalk-koan-4.3.6-150000.3.33.2.noarch", product_id: "spacewalk-koan-4.3.6-150000.3.33.2.noarch", }, }, { category: "product_version", name: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", product: { name: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", product_id: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", }, }, ], category: "architecture", name: "noarch", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", product: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", product_id: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", }, }, { category: "product_version", name: "grafana-9.5.18-150000.1.63.2.ppc64le", product: { name: "grafana-9.5.18-150000.1.63.2.ppc64le", product_id: "grafana-9.5.18-150000.1.63.2.ppc64le", }, }, { category: "product_version", name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", product: { name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", product_id: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", }, }, { category: "product_version", name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", product: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", product_id: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", product: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", product_id: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", }, }, { category: "product_version", name: "grafana-9.5.18-150000.1.63.2.s390x", product: { name: "grafana-9.5.18-150000.1.63.2.s390x", product_id: "grafana-9.5.18-150000.1.63.2.s390x", }, }, { category: "product_version", name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", product: { name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", product_id: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", }, }, { category: "product_version", name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", product: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", product_id: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", product: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", product_id: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", }, }, { category: "product_version", name: "grafana-9.5.18-150000.1.63.2.x86_64", product: { name: "grafana-9.5.18-150000.1.63.2.x86_64", product_id: "grafana-9.5.18-150000.1.63.2.x86_64", }, }, { category: "product_version", name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", product: { name: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", product_id: "python2-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", }, }, { category: "product_version", name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", product: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", product_id: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "SUSE Manager Client Tools 15", product: { name: "SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15", }, }, { category: "product_name", name: "SUSE Manager Client Tools for SLE Micro 5", product: { name: "SUSE Manager Client Tools for SLE Micro 5", product_id: "SUSE Manager Client Tools for SLE Micro 5", product_identification_helper: { cpe: "cpe:/o:suse:sle-manager-tools-micro:5", }, }, }, { category: "product_name", name: "SUSE Linux Enterprise Module for Package Hub 15 SP5", product: { name: "SUSE Linux Enterprise Module for Package Hub 15 SP5", product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP5", product_identification_helper: { cpe: "cpe:/o:suse:packagehub:15:sp5", }, }, }, { category: "product_name", name: "SUSE Manager Proxy Module 4.3", product: { name: "SUSE Manager Proxy Module 4.3", product_id: "SUSE Manager Proxy Module 4.3", product_identification_helper: { cpe: "cpe:/o:suse:sle-module-suse-manager-proxy:4.3", }, }, }, { category: "product_name", name: "openSUSE Leap 15.5", product: { name: "openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5", product_identification_helper: { cpe: "cpe:/o:opensuse:leap:15.5", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, product_reference: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, product_reference: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "ansible-2.9.27-150000.1.17.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-2.9.27-150000.1.17.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-doc-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", }, product_reference: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.18-150000.1.63.2.aarch64 as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", }, product_reference: "grafana-9.5.18-150000.1.63.2.aarch64", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.18-150000.1.63.2.ppc64le as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", }, product_reference: "grafana-9.5.18-150000.1.63.2.ppc64le", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.18-150000.1.63.2.s390x as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", }, product_reference: "grafana-9.5.18-150000.1.63.2.s390x", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "grafana-9.5.18-150000.1.63.2.x86_64 as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", }, product_reference: "grafana-9.5.18-150000.1.63.2.x86_64", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "mgr-daemon-4.3.9-150000.1.47.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", }, product_reference: "mgr-daemon-4.3.9-150000.1.47.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-check-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", }, product_reference: "python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", }, product_reference: "python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", }, product_reference: "python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", }, product_reference: "python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64 as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", }, product_reference: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", }, product_reference: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", }, product_reference: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64 as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", }, product_reference: "python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "spacecmd-4.3.27-150000.3.116.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", }, product_reference: "spacecmd-4.3.27-150000.3.116.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "spacewalk-check-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", }, product_reference: "spacewalk-check-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "spacewalk-client-setup-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", }, product_reference: "spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "spacewalk-client-tools-4.3.19-150000.3.89.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", }, product_reference: "spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "spacewalk-koan-4.3.6-150000.3.33.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", }, product_reference: "spacewalk-koan-4.3.6-150000.3.33.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch as component of SUSE Manager Client Tools 15", product_id: "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", }, product_reference: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools 15", }, { category: "default_component_of", full_product_name: { name: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch as component of SUSE Manager Client Tools for SLE Micro 5", product_id: "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", }, product_reference: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch as component of SUSE Manager Client Tools for SLE Micro 5", product_id: "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", }, product_reference: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", relates_to_product_reference: "SUSE Manager Client Tools for SLE Micro 5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP5", product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", relates_to_product_reference: "SUSE Linux Enterprise Module for Package Hub 15 SP5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP5", product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", relates_to_product_reference: "SUSE Linux Enterprise Module for Package Hub 15 SP5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP5", product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", relates_to_product_reference: "SUSE Linux Enterprise Module for Package Hub 15 SP5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP5", product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", relates_to_product_reference: "SUSE Linux Enterprise Module for Package Hub 15 SP5", }, { category: "default_component_of", full_product_name: { name: "ansible-2.9.27-150000.1.17.2.noarch as component of SUSE Manager Proxy Module 4.3", product_id: "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "SUSE Manager Proxy Module 4.3", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-2.9.27-150000.1.17.2.noarch as component of SUSE Manager Proxy Module 4.3", product_id: "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-doc-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "SUSE Manager Proxy Module 4.3", }, { category: "default_component_of", full_product_name: { name: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch as component of SUSE Manager Proxy Module 4.3", product_id: "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", }, product_reference: "uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", relates_to_product_reference: "SUSE Manager Proxy Module 4.3", }, { category: "default_component_of", full_product_name: { name: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, product_reference: "POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", }, product_reference: "POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "ansible-2.9.27-150000.1.17.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "ansible-doc-2.9.27-150000.1.17.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-doc-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "ansible-test-2.9.27-150000.1.17.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", }, product_reference: "ansible-test-2.9.27-150000.1.17.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", }, product_reference: "dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64 as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64 as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", }, product_reference: "golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", relates_to_product_reference: "openSUSE Leap 15.5", }, { category: "default_component_of", full_product_name: { name: "spacecmd-4.3.27-150000.3.116.2.noarch as component of openSUSE Leap 15.5", product_id: "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", }, product_reference: "spacecmd-4.3.27-150000.3.116.2.noarch", relates_to_product_reference: "openSUSE Leap 15.5", }, ], }, vulnerabilities: [ { cve: "CVE-2016-8614", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8614", }, ], notes: [ { category: "general", text: "A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-8614", url: "https://www.suse.com/security/cve/CVE-2016-8614", }, { category: "external", summary: "SUSE Bug 1008038 for CVE-2016-8614", url: "https://bugzilla.suse.com/1008038", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2016-8614", }, { cve: "CVE-2016-8628", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8628", }, ], notes: [ { category: "general", text: "Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-8628", url: "https://www.suse.com/security/cve/CVE-2016-8628", }, { category: "external", summary: "SUSE Bug 1008037 for CVE-2016-8628", url: "https://bugzilla.suse.com/1008037", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 9.1, baseSeverity: "CRITICAL", vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2016-8628", }, { cve: "CVE-2016-8647", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-8647", }, ], notes: [ { category: "general", text: "An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-8647", url: "https://www.suse.com/security/cve/CVE-2016-8647", }, { category: "external", summary: "SUSE Bug 1008038 for CVE-2016-8647", url: "https://bugzilla.suse.com/1008038", }, { category: "external", summary: "SUSE Bug 1010940 for CVE-2016-8647", url: "https://bugzilla.suse.com/1010940", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 4.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "low", }, ], title: "CVE-2016-8647", }, { cve: "CVE-2016-9587", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2016-9587", }, ], notes: [ { category: "general", text: "Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2016-9587", url: "https://www.suse.com/security/cve/CVE-2016-9587", }, { category: "external", summary: "SUSE Bug 1019021 for CVE-2016-9587", url: "https://bugzilla.suse.com/1019021", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 8.1, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "important", }, ], title: "CVE-2016-9587", }, { cve: "CVE-2017-7550", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2017-7550", }, ], notes: [ { category: "general", text: "A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the \"params\" argument, and noting this in the module documentation.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2017-7550", url: "https://www.suse.com/security/cve/CVE-2017-7550", }, { category: "external", summary: "SUSE Bug 1035124 for CVE-2017-7550", url: "https://bugzilla.suse.com/1035124", }, { category: "external", summary: "SUSE Bug 1065872 for CVE-2017-7550", url: "https://bugzilla.suse.com/1065872", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 8.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", version: "3.0", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "important", }, ], title: "CVE-2017-7550", }, { cve: "CVE-2018-10874", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2018-10874", }, ], notes: [ { category: "general", text: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2018-10874", url: "https://www.suse.com/security/cve/CVE-2018-10874", }, { category: "external", summary: "SUSE Bug 1097775 for CVE-2018-10874", url: "https://bugzilla.suse.com/1097775", }, { category: "external", summary: "SUSE Bug 1099805 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099805", }, { category: "external", summary: "SUSE Bug 1099808 for CVE-2018-10874", url: "https://bugzilla.suse.com/1099808", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "important", }, ], title: "CVE-2018-10874", }, { cve: "CVE-2020-10744", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-10744", }, ], notes: [ { category: "general", text: "An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-10744", url: "https://www.suse.com/security/cve/CVE-2020-10744", }, { category: "external", summary: "SUSE Bug 1171823 for CVE-2020-10744", url: "https://bugzilla.suse.com/1171823", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2020-10744", }, { cve: "CVE-2020-14330", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-14330", }, ], notes: [ { category: "general", text: "An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-14330", url: "https://www.suse.com/security/cve/CVE-2020-14330", }, { category: "external", summary: "SUSE Bug 1174145 for CVE-2020-14330", url: "https://bugzilla.suse.com/1174145", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 3.3, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2020-14330", }, { cve: "CVE-2020-14332", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-14332", }, ], notes: [ { category: "general", text: "A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-14332", url: "https://www.suse.com/security/cve/CVE-2020-14332", }, { category: "external", summary: "SUSE Bug 1174302 for CVE-2020-14332", url: "https://bugzilla.suse.com/1174302", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2020-14332", }, { cve: "CVE-2020-14365", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-14365", }, ], notes: [ { category: "general", text: "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-14365", url: "https://www.suse.com/security/cve/CVE-2020-14365", }, { category: "external", summary: "SUSE Bug 1175993 for CVE-2020-14365", url: "https://bugzilla.suse.com/1175993", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2020-14365", }, { cve: "CVE-2020-1753", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2020-1753", }, ], notes: [ { category: "general", text: "A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2020-1753", url: "https://www.suse.com/security/cve/CVE-2020-1753", }, { category: "external", summary: "SUSE Bug 1166389 for CVE-2020-1753", url: "https://bugzilla.suse.com/1166389", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2020-1753", }, { cve: "CVE-2023-5764", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-5764", }, ], notes: [ { category: "general", text: "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2023-5764", url: "https://www.suse.com/security/cve/CVE-2023-5764", }, { category: "external", summary: "SUSE Bug 1216854 for CVE-2023-5764", url: "https://bugzilla.suse.com/1216854", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2023-5764", }, { cve: "CVE-2023-6152", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2023-6152", }, ], notes: [ { category: "general", text: "A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2023-6152", url: "https://www.suse.com/security/cve/CVE-2023-6152", }, { category: "external", summary: "SUSE Bug 1219912 for CVE-2023-6152", url: "https://bugzilla.suse.com/1219912", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.4, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2023-6152", }, { cve: "CVE-2024-0690", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-0690", }, ], notes: [ { category: "general", text: "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2024-0690", url: "https://www.suse.com/security/cve/CVE-2024-0690", }, { category: "external", summary: "SUSE Bug 1219002 for CVE-2024-0690", url: "https://bugzilla.suse.com/1219002", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 5.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2024-0690", }, { cve: "CVE-2024-1313", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-1313", }, ], notes: [ { category: "general", text: "It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.\n\nGrafana Labs would like to thank Ravid Mazon and Jay Chen of Palo \nAlto Research for discovering and disclosing this vulnerability.\n\nThis issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.\n\n", title: "CVE description", }, ], product_status: { recommended: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, references: [ { category: "external", summary: "CVE-2024-1313", url: "https://www.suse.com/security/cve/CVE-2024-1313", }, { category: "external", summary: "SUSE Bug 1222155 for CVE-2024-1313", url: "https://bugzilla.suse.com/1222155", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "SUSE Linux Enterprise Module for Package Hub 15 SP5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "SUSE Manager Client Tools 15:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "SUSE Manager Client Tools 15:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Client Tools 15:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.aarch64", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.ppc64le", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.s390x", "SUSE Manager Client Tools 15:grafana-9.5.18-150000.1.63.2.x86_64", "SUSE Manager Client Tools 15:mgr-daemon-4.3.9-150000.1.47.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:python3-spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.aarch64", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.ppc64le", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.s390x", "SUSE Manager Client Tools 15:python3-uyuni-common-libs-4.3.10-150000.1.39.2.x86_64", "SUSE Manager Client Tools 15:spacecmd-4.3.27-150000.3.116.2.noarch", "SUSE Manager Client Tools 15:spacewalk-check-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-setup-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-client-tools-4.3.19-150000.3.89.2.noarch", "SUSE Manager Client Tools 15:spacewalk-koan-4.3.6-150000.3.33.2.noarch", "SUSE Manager Client Tools 15:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "SUSE Manager Client Tools for SLE Micro 5:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:ansible-doc-2.9.27-150000.1.17.2.noarch", "SUSE Manager Proxy Module 4.3:uyuni-proxy-systemd-services-4.3.12-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-Graphical7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:POS_Image-JeOS7-0.1.1710765237.46af599-150000.1.21.2.noarch", "openSUSE Leap 15.5:ansible-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-doc-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:ansible-test-2.9.27-150000.1.17.2.noarch", "openSUSE Leap 15.5:dracut-saltboot-0.1.1710765237.46af599-150000.1.53.2.noarch", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.aarch64", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.ppc64le", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.s390x", "openSUSE Leap 15.5:golang-github-prometheus-promu-0.14.0-150000.3.18.2.x86_64", "openSUSE Leap 15.5:spacecmd-4.3.27-150000.3.116.2.noarch", ], }, ], threats: [ { category: "impact", date: "2024-05-06T09:47:44Z", details: "moderate", }, ], title: "CVE-2024-1313", }, ], }
fkie_cve-2018-10874
Vulnerability from fkie_nvd
Published
2018-07-02 13:29
Modified
2024-11-21 03:42
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | ansible_engine | 2.0 | |
| redhat | ansible_engine | 2.4 | |
| redhat | ansible_engine | 2.5 | |
| redhat | ansible_engine | 2.6 | |
| redhat | openstack | 10 | |
| redhat | openstack | 12 | |
| redhat | openstack | 13 | |
| redhat | virtualization | 4.0 | |
| redhat | virtualization_host | 4.0 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*", matchCriteriaId: "8989CD03-49A1-4831-BF98-9F21592788BE", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*", matchCriteriaId: "5864D753-2A37-4800-A73E-6ACA0662B605", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*", matchCriteriaId: "4C5A40D5-4DF7-43D9-962E-1529D2DF198D", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*", matchCriteriaId: "13BACD7C-AC7E-4D86-8D9B-ABB614005D0C", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", matchCriteriaId: "E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*", matchCriteriaId: "4D4AC996-B340-4A14-86F7-FF83B4D5EC8F", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*", matchCriteriaId: "704CFA1A-953E-4105-BFBE-406034B83DED", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*", matchCriteriaId: "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*", matchCriteriaId: "BB28F9AF-3D06-4532-B397-96D7E4792503", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", }, { lang: "es", value: "En Ansible, se ha descubierto que las variables de inventario se cargan desde el directorio de trabajo actual cuando se ejecutan comandos ad-hoc bajo el control del atacante, lo que permite la ejecución de código arbitrario como resultado.", }, ], id: "CVE-2018-10874", lastModified: "2024-11-21T03:42:11.677", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 4.6, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 3.9, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "secalert@redhat.com", type: "Secondary", }, { cvssData: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 1.8, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2018-07-02T13:29:00.367", references: [ { source: "secalert@redhat.com", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1041396", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { source: "secalert@redhat.com", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { source: "secalert@redhat.com", url: "https://usn.ubuntu.com/4072-1/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1041396", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://usn.ubuntu.com/4072-1/", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-426", }, ], source: "secalert@redhat.com", type: "Primary", }, { description: [ { lang: "en", value: "CWE-20", }, ], source: "nvd@nist.gov", type: "Secondary", }, ], }
ghsa-3xvg-x47j-x75w
Vulnerability from github
Published
2022-05-13 01:07
Modified
2024-09-09 21:00
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.5 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.5 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Ansible Improper Input Validation vulnerability
Details
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
{ affected: [ { package: { ecosystem: "PyPI", name: "ansible", }, ranges: [ { events: [ { introduced: "0", }, { fixed: "2.4.6.0", }, ], type: "ECOSYSTEM", }, ], }, { package: { ecosystem: "PyPI", name: "ansible", }, ranges: [ { events: [ { introduced: "2.5", }, { fixed: "2.5.6", }, ], type: "ECOSYSTEM", }, ], }, { package: { ecosystem: "PyPI", name: "ansible", }, ranges: [ { events: [ { introduced: "2.6", }, { fixed: "2.6.1", }, ], type: "ECOSYSTEM", }, ], }, ], aliases: [ "CVE-2018-10874", ], database_specific: { cwe_ids: [ "CWE-20", "CWE-426", ], github_reviewed: true, github_reviewed_at: "2023-02-08T18:08:29Z", nvd_published_at: "2018-07-02T13:29:00Z", severity: "HIGH", }, details: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", id: "GHSA-3xvg-x47j-x75w", modified: "2024-09-09T21:00:14Z", published: "2022-05-13T01:07:34Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", }, { type: "WEB", url: "https://github.com/ansible/ansible/pull/42067", }, { type: "WEB", url: "https://github.com/ansible/ansible/commit/44874addc7ea136f83c67d5869047ece02645fdb", }, { type: "WEB", url: "https://github.com/ansible/ansible/commit/1f80949f964a946773f9d3ac1899535bd2cc2b8e", }, { type: "WEB", url: "https://github.com/ansible/ansible/commit/10d6fe6c98cfee9a7be0fea6102ba5dec951aec7", }, { type: "WEB", url: "https://web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396", }, { type: "WEB", url: "https://usn.ubuntu.com/4072-1", }, { type: "WEB", url: "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-81.yaml", }, { type: "PACKAGE", url: "https://github.com/ansible/ansible", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1596528", }, { type: "WEB", url: "https://access.redhat.com/security/cve/CVE-2018-10874", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { type: "WEB", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { type: "WEB", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, ], schema_version: "1.4.0", severity: [ { score: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", type: "CVSS_V3", }, { score: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", type: "CVSS_V4", }, ], summary: "Ansible Improper Input Validation vulnerability", }
gsd-2018-10874
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Aliases
Aliases
{ GSD: { alias: "CVE-2018-10874", description: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", id: "GSD-2018-10874", references: [ "https://www.suse.com/security/cve/CVE-2018-10874.html", "https://access.redhat.com/errata/RHSA-2019:0054", "https://access.redhat.com/errata/RHBA-2018:3788", "https://access.redhat.com/errata/RHSA-2018:2585", "https://access.redhat.com/errata/RHSA-2018:2321", "https://access.redhat.com/errata/RHSA-2018:2166", "https://access.redhat.com/errata/RHSA-2018:2152", "https://access.redhat.com/errata/RHSA-2018:2151", "https://access.redhat.com/errata/RHSA-2018:2150", "https://ubuntu.com/security/CVE-2018-10874", "https://advisories.mageia.org/CVE-2018-10874.html", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2018-10874", ], details: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", id: "GSD-2018-10874", modified: "2023-12-13T01:22:40.955661Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2018-10874", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "ansible", version: { version_data: [ { version_affected: "=", version_value: "n/a", }, ], }, }, ], }, vendor_name: "[UNKNOWN]", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", }, ], }, impact: { cvss: [ { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, ], }, problemtype: { problemtype_data: [ { description: [ { cweId: "CWE-426", lang: "eng", value: "CWE-426", }, ], }, ], }, references: { reference_data: [ { name: "http://www.securitytracker.com/id/1041396", refsource: "MISC", url: "http://www.securitytracker.com/id/1041396", }, { name: "https://access.redhat.com/errata/RHBA-2018:3788", refsource: "MISC", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { name: "https://access.redhat.com/errata/RHSA-2018:2150", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { name: "https://access.redhat.com/errata/RHSA-2018:2151", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { name: "https://access.redhat.com/errata/RHSA-2018:2152", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { name: "https://access.redhat.com/errata/RHSA-2018:2166", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { name: "https://access.redhat.com/errata/RHSA-2018:2321", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { name: "https://access.redhat.com/errata/RHSA-2018:2585", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { name: "https://access.redhat.com/errata/RHSA-2019:0054", refsource: "MISC", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", refsource: "MISC", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { name: "https://usn.ubuntu.com/4072-1/", refsource: "MISC", url: "https://usn.ubuntu.com/4072-1/", }, ], }, }, "gitlab.com": { advisories: [ { affected_range: "==2.0||>=2.4,<=2.6", affected_versions: "Version 2.0, all versions starting from 2.4 up to 2.6", cvss_v2: "AV:L/AC:L/Au:N/C:P/I:P/A:P", cvss_v3: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", cwe_ids: [ "CWE-1035", "CWE-20", "CWE-937", ], date: "2019-07-25", description: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control. The attacker can run arbitrary code as a result.", fixed_versions: [ "2.0.0.1", "2.6.1", ], identifier: "CVE-2018-10874", identifiers: [ "CVE-2018-10874", ], not_impacted: "All versions before 2.0, all versions after 2.0 before 2.4, all versions after 2.6", package_slug: "pypi/ansible", pubdate: "2018-07-02", solution: "Upgrade to versions 2.0.0.1, 2.6.1 or above.", title: "Improper Input Validation", urls: [ "https://nvd.nist.gov/vuln/detail/CVE-2018-10874", "http://www.securitytracker.com/id/1041396", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", ], uuid: "094a51ef-538c-4c94-b78c-28f497c9828d", }, ], }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:ansible_engine:2.4:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2018-10874", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-426", }, ], }, ], }, references: { reference_data: [ { name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", refsource: "CONFIRM", tags: [ "Issue Tracking", "Vendor Advisory", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { name: "RHSA-2018:2166", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { name: "RHSA-2018:2152", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { name: "RHSA-2018:2151", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { name: "RHSA-2018:2150", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { name: "RHSA-2018:2321", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { name: "1041396", refsource: "SECTRACK", tags: [ "Third Party Advisory", "VDB Entry", ], url: "http://www.securitytracker.com/id/1041396", }, { name: "RHSA-2018:2585", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { name: "RHBA-2018:3788", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { name: "RHSA-2019:0054", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { name: "USN-4072-1", refsource: "UBUNTU", tags: [], url: "https://usn.ubuntu.com/4072-1/", }, ], }, }, impact: { baseMetricV2: { acInsufInfo: false, cvssV2: { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 4.6, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 3.9, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, baseMetricV3: { cvssV3: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 1.8, impactScore: 5.9, }, }, lastModifiedDate: "2023-02-13T04:51Z", publishedDate: "2018-07-02T13:29Z", }, }, }
pysec-2018-81
Vulnerability from pysec
Published
2018-07-02 13:29
Modified
2021-11-11 23:46
Details
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Impacted products
| Name | purl |
|---|---|
| ansible | pkg:pypi/ansible |
Aliases
{ affected: [ { package: { ecosystem: "PyPI", name: "ansible", purl: "pkg:pypi/ansible", }, ranges: [ { events: [ { introduced: "0", }, { fixed: "2.4.6.0", }, { introduced: "2.5", }, { fixed: "2.5.6", }, { introduced: "2.6", }, { fixed: "2.6.1", }, ], type: "ECOSYSTEM", }, ], versions: [ "1.0", "1.1", "1.2", "1.2.1", "1.2.2", "1.2.3", "1.3.0", "1.3.1", "1.3.2", "1.3.3", "1.3.4", "1.4", "1.4.1", "1.4.2", "1.4.3", "1.4.4", "1.4.5", "1.5", "1.5.1", "1.5.2", "1.5.3", "1.5.4", "1.5.5", "1.6", "1.6.1", "1.6.10", "1.6.2", "1.6.3", "1.6.4", "1.6.5", "1.6.6", "1.6.7", "1.6.8", "1.6.9", "1.7", "1.7.1", "1.7.2", "1.8", "1.8.1", "1.8.2", "1.8.3", "1.8.4", "1.9.0", "1.9.0.1", "1.9.1", "1.9.2", "1.9.3", "1.9.4", "1.9.5", "1.9.6", "2.0.0", "2.0.0.0", "2.0.0.1", "2.0.0.2", "2.0.1.0", "2.0.2.0", "2.1.0.0", "2.1.1.0", "2.1.2.0", "2.1.3.0", "2.1.4.0", "2.1.5.0", "2.1.6.0", "2.2.0.0", "2.2.1.0", "2.2.2.0", "2.2.3.0", "2.3.0.0", "2.3.1.0", "2.3.2.0", "2.3.3.0", "2.4.0.0", "2.4.1.0", "2.4.2.0", "2.4.3.0", "2.4.4.0", "2.4.5.0", "2.5.0", "2.5.1", "2.5.2", "2.5.3", "2.5.4", "2.5.5", "2.6.0", ], }, ], aliases: [ "CVE-2018-10874", ], details: "In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.", id: "PYSEC-2018-81", modified: "2021-11-11T23:46:36.679476Z", published: "2018-07-02T13:29:00Z", references: [ { type: "REPORT", url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2166", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2152", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2151", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2150", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2321", }, { type: "WEB", url: "http://www.securitytracker.com/id/1041396", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2018:2585", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHBA-2018:3788", }, { type: "ADVISORY", url: "https://access.redhat.com/errata/RHSA-2019:0054", }, { type: "WEB", url: "https://usn.ubuntu.com/4072-1/", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.