Bugzilla – Bug 1065872
VUL-0: CVE-2017-7550 ansible: jenkins_plugin module exposes passwords in remote host logs
Last modified: 2022-04-12 15:14:38 UTC
https://github.com/ansible/ansible/blob/v2.4.1.0-1/CHANGELOG.md Security fix for CVE-2017-7550: the jenkins_plugin module was logging the jenkins server password if the url_password was passed via the params field: https://github.com/ansible/ansible/pull/30875 The fix is to disallow url_password in the module params + doc update. https://github.com/ansible/ansible/pull/30875/commits/c80415389a13c2c3373966c736691dff493aab34 Fixed in 2.4.1.0 References: https://bugzilla.redhat.com/show_bug.cgi?id=1473645 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7550 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7550.html https://rhn.redhat.com/errata/RHSA-2017-2966.html https://access.redhat.com/errata/RHSA-2017:2966 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7550
openSUSE-SU-2017:2976-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1008037,1008038,1019021,1038785,1065872 CVE References: CVE-2016-8614,CVE-2016-8628,CVE-2016-9587,CVE-2017-7481,CVE-2017-7550 Sources used: openSUSE Leap 42.3 (src): ansible-2.4.1.0-6.1 openSUSE Leap 42.2 (src): ansible-2.4.1.0-2.4.1
openSUSE-SU-2017:2978-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1008037,1008038,1019021,1038785,1065872 CVE References: CVE-2016-8614,CVE-2016-8628,CVE-2016-9587,CVE-2017-7481,CVE-2017-7550 Sources used: SUSE Package Hub for SUSE Linux Enterprise 12 (src): ansible-2.4.1.0-6.1
Well the submission for TD is in place so nothing more should be needed from pack team.
Cloud 7 OpenStack-Cloud_7 SUSE:SLE-12-SP2:Update:Products:Cloud7:Update
this has been submitted as far as I can see. I've updated the version for cloud 8 (crowbar). SOC8 remains affected.
SUSE-SU-2018:0605-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1065872 CVE References: CVE-2017-7550 Sources used: SUSE OpenStack Cloud 7 (src): ansible-2.2.3.0-9.1
done