-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: ansible security and bug fix update Advisory ID: RHSA-2019:1707-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2019:1707 Issue date: 2019-07-09 CVE Names: CVE-2019-10156 ==================================================================== 1. Summary: An update for ansible is now available for Ansible Engine 2.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Engine 2.6 for RHEL 7 Server - noarch 3. Description: Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.6.18) Security fix(es): * ansible: unsafe template evaluation of returned module data can lead to information disclosure (CVE-2019-10156) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): See: https://github.com/ansible/ansible/blob/v2.6.18/changelogs/CHANGELOG-v2.6.r st for details on bug fixes in this release. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1717311 - CVE-2019-10156 ansible: unsafe template evaluation of returned module data can lead to information disclosure 6. Package List: Red Hat Ansible Engine 2.6 for RHEL 7 Server: Source: ansible-2.6.18-1.el7ae.src.rpm noarch: ansible-2.6.18-1.el7ae.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-10156 https://access.redhat.com/security/updates/classification/#moderate https://github.com/ansible/ansible/blob/v2.6.18/changelogs/CHANGELOG-v2.6.rst 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXSRiX9zjgjWX9erEAQiUmA//RaKI6d96I2mfptrN5FEXsbwl+didj/HM vi2GNkXNH7MH2npvWOf8Xwob4yvJuilcOj3PBVQEgIb74XXnB/FraIJrAHwJ5f+Q GaBThBJqkytVoRAke4BIYsACHKvsb78ImftUN/h2soppFW2qcdFwycPJswwb1/6X CwAHTkFgON/5mMhVpp6jbLBJQPprS+51dAZBycLr0bcuwXOeZf4TvqJOtdyRfEY0 jeaTAGJ99YU37JnHRyEPo8Rkc55Zr4GzwFl6GA8QssZ/cZASmpBkbm0ImKsWzN+U 2XLrewG+laHRqDVn8x9nxmSWhvdHIDBO6BYwKZKIcgCzoneX56lTS2YoOg7u+SaC Zx3x2cY9se+EzD64pN3ZYier/WMBXYO86DTQ1bQd+7wXG3Iwue0gLYw4L6wqWvJe dTUtcPnQ36QCXY5vHQPVs0zVAYuxEtSEGf/xu4ypR70GbKQA2hTE9M4sPj4wh9Cj ED/4cJgRPrAcjSmOg3teMDKS9MsUbXs5nKwKRhvuaIbo59yukW9iZA0T7oNwLtlx eSH8vyxANIS5yUAf39uFn8IgkpHEGpAJOmLPTqcbdmCCvj2SbPRw5nv2xACOXwwK BVU8BdjNG+HU+YHsZBiEyMLWpWGSv86w9LKrnq13PcFHwoOv/dLOCWsqMyKrRUGr NrBXCSZrhXs=2oCz -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce