[RHSA-2017:0195-01] Important: ansible security update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Important: ansible security update

Advisory ID: RHSA-2017:0195-01

Product: Red Hat Enterprise Linux OpenStack Platform

Advisory URL: https://rhn.redhat.com/errata/RHSA-2017-0195.html

Issue date: 2017-01-25

CVE Names: CVE-2016-9587

=====================================================================

 

1. Summary:

 

An update for ansible is now available for Red Hat OpenStack Platform 10.0

(Newton).

 

Red Hat Product Security has rated this update as having a security impact

of Important. A Common Vulnerability Scoring System (CVSS) base score,

which gives a detailed severity rating, is available for each vulnerability

from the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat OpenStack Platform 10.0 - noarch

 

3. Description:

 

Ansible is a radically simple model-driven configuration management,

multi-node deployment, and remote task execution system. Ansible works over

SSH and does not require any software or daemons to be installed on remote

nodes. Extension modules can be written in any language and are transferred

to managed machines automatically.

 

The following packages have been upgraded to a newer upstream version:

ansible (2.2.1.0). (BZ#1412370)

 

Security Fix(es):

 

* An input validation vulnerability was found in Ansible's handling of data

sent from client systems. An attacker with control over a client system

being managed by Ansible and the ability to send facts back to the Ansible

server could use this flaw to execute arbitrary code on the Ansible server

using the Ansible-server privileges. (CVE-2016-9587)

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1404378 - CVE-2016-9587 Ansible: Compromised remote hosts can lead to running commands on the Ansible controller

 

6. Package List:

 

Red Hat OpenStack Platform 10.0:

 

Source:

ansible-2.2.1.0-1.el7.src.rpm

 

noarch:

ansible-2.2.1.0-1.el7.noarch.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2016-9587

https://access.redhat.com/security/updates/classification/#important

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2017 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFYiSXOXlSAg2UNWIIRAomCAJ0bXrV5SWuMuCV1azYs9+oYv7PL7QCdEgLy

qUxzD0QCO6TP449uVqd7dJw=

=SCLH

-----END PGP SIGNATURE-----

 

 

--