{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"moderate"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"Security update for ansible","title":"Title of the patch"},{"category":"description","text":"This update for ansible fixes the following issues:\n\nAnsible was updated to version 2.8.1:\n\nFull changelog is at /usr/share/doc/packages/ansible/changelogs/\n\n- Bugfixes\n\n  - ACI - DO not encode query_string\n  - ACI modules - Fix non-signature authentication\n  - Add missing directory provided via ``--playbook-dir`` to adjacent collection loading\n  - Fix 'Interface not found' errors when using eos_l2_interface with nonexistant\n    interfaces configured\n  - Fix cannot get credential when `source_auth` set to `credential_file`.\n  - Fix netconf_config backup string issue\n  - Fix privilege escalation support for the docker connection plugin when\n    credentials need to be supplied (e.g. sudo with password).\n  - Fix vyos cli prompt inspection\n  - Fixed loading namespaced documentation fragments from collections.\n  - Fixing bug came up after running cnos_vrf module against coverity.\n  - Properly handle data importer failures on PVC creation, instead of timing out.\n  - To fix the ios static route TC failure in CI\n  - To fix the nios member module params\n  - To fix the nios_zone module idempotency failure\n  - add terminal initial prompt for initial connection\n  - allow include_role to work with ansible command\n  - allow python_requirements_facts to report on dependencies containing dashes\n  - asa_config fix\n  - azure_rm_roledefinition - fix a small error in build scope.\n  - azure_rm_virtualnetworkpeering - fix cross subscriptions virtual network\n    peering.\n  - cgroup_perf_recap - When not using file_per_task, make sure we don't\n    prematurely close the perf files\n  - display underlying error when reporting an invalid ``tasks:`` block.\n  - dnf - fix wildcard matching for state: absent\n  - docker connection plugin - accept version ``dev`` as 'newest version' and\n    print warning.\n  - docker_container - ``oom_killer`` and ``oom_score_adj`` options are available\n    since docker-py 1.8.0, not 2.0.0 as assumed by the version check.\n  - docker_container - fix network creation when ``networks_cli_compatible`` is\n    enabled.\n  - docker_container - use docker API's ``restart`` instead of ``stop``/``start``\n    to restart a container.\n  - docker_image - if ``build`` was not specified, the wrong default for\n    ``build.rm`` is used.\n  - docker_image - if ``nocache`` set to ``yes`` but not ``build.nocache``, the\n    module failed.\n  - docker_image - module failed when ``source: build`` was set but\n    ``build.path`` options not specified.\n  - docker_network module - fix idempotency when using ``aux_addresses`` in\n    ``ipam_config``.\n  - ec2_instance - make Name tag idempotent\n  - eos: don't fail modules without become set, instead show message and continue\n  - eos_config: check for session support when asked to 'diff_against: session'\n  - eos_eapi: fix idempotency issues when vrf was unspecified.\n  - fix bugs for ce - more info see\n  - fix incorrect uses of to_native that should be to_text instead.\n  - hcloud_volume - Fix idempotency when attaching a server to a volume.\n  - ibm_storage - Added a check for null fields in ibm_storage utils module.\n  - include_tasks - whitelist ``listen`` as a valid keyword\n  - k8s - resource updates applied with force work correctly now\n  - keep results subset also when not no_log.\n  - meraki_switchport - improve reliability with native VLAN functionality.\n  - netapp_e_iscsi_target - fix netapp_e_iscsi_target chap secret size and\n    clearing functionality\n  - netapp_e_volumes - fix workload profileId indexing when no previous workload\n    tags exist on the storage array.\n  - nxos_acl some platforms/versions raise when no ACLs are present\n  - nxos_facts fix <https://github.com/ansible/ansible/pull/57009>\n  - nxos_file_copy fix passwordless workflow\n  - nxos_interface Fix admin_state check for n6k\n  - nxos_snmp_traps fix group all for N35 platforms\n  - nxos_snmp_user fix platform fixes for get_snmp_user\n  - nxos_vlan mode idempotence bug\n  - nxos_vlan vlan names containing regex ctl chars should be escaped\n  - nxos_vtp_* modules fix n6k issues\n  - openssl_certificate - fix private key passphrase handling for\n    ``cryptography`` backend.\n  - openssl_pkcs12 - fixes crash when private key has a passphrase and the module\n    is run a second time.\n  - os_stack - Apply tags conditionally so that the module does not throw up an\n    error when using an older distro of openstacksdk\n  - pass correct loading context to persistent connections other than local\n  - pkg_mgr - Ansible 2.8.0 failing to install yum packages on Amazon Linux\n  - postgresql - added initial SSL related tests\n  - postgresql - added missing_required_libs, removed excess param mapping\n  - postgresql - move connect_to_db and get_pg_version into\n    module_utils/postgres.py (https://github.com/ansible/ansible/pull/55514)\n  - postgresql_db - add note to the documentation about state dump and the\n    incorrect rc (https://github.com/ansible/ansible/pull/57297)\n  - postgresql_db - fix for postgresql_db fails if stderr contains output\n  - postgresql_ping - fixed a typo in the module documentation\n  - preserve actual ssh error when we cannot connect.\n  - route53_facts - the module did not advertise check mode support, causing it\n    not to be run in check mode.\n  - sysctl: the module now also checks the output of STDERR to report if values\n    are correctly set (https://github.com/ansible/ansible/pull/55695)\n  - ufw - correctly check status when logging is off\n  - uri - always return a value for status even during failure\n  - urls - Handle redirects properly for IPv6 address by not splitting on ``:``\n    and rely on already parsed hostname and port values\n  - vmware_vm_facts - fix the support with regular ESXi\n  - vyos_interface fix <https://github.com/ansible/ansible/pull/57169>\n  - we don't really need to template vars on definition as we do this on demand\n    in templating.\n  - win_acl - Fix qualifier parser when using UNC paths -\n  - win_hostname - Fix non netbios compliant name handling\n  - winrm - Fix issue when attempting to parse CLIXML on send input failure\n  - xenserver_guest - fixed an issue where VM whould be powered off even though\n    check mode is used if reconfiguration requires VM to be powered off.\n  - xenserver_guest - proper error message is shown when maximum number of\n    network interfaces is reached and multiple network interfaces are added at\n    once.\n  - yum - Fix false error message about autoremove not being supported\n  - yum - fix failure when using ``update_cache`` standalone\n  - yum - handle special '_none_' value for proxy in yum.conf and .repo files\n\nUpdate to version 2.8.0\n\nMajor changes:\n\n  * Experimental support for Ansible Collections and content namespacing -\n    Ansible content can now be packaged in a collection and addressed via\n    namespaces. This allows for easier sharing, distribution, and installation\n    of bundled modules/roles/plugins, and consistent rules for accessing\n    specific content via namespaces.\n  * Python interpreter discovery - The first time a Python module runs on a\n    target, Ansible will attempt to discover the proper default Python\n    interpreter to use for the target platform/version (instead of immediately\n    defaulting to /usr/bin/python). You can override this behavior by\n    setting ansible_python_interpreter or via config. \n    (see https://github.com/ansible/ansible/pull/50163)\n  * become - The deprecated CLI arguments for --sudo, --sudo-user,\n    --ask-sudo-pass, -su, --su-user, and --ask-su-pass have been removed, in\n    favor of the more generic --become, --become-user, --become-method, and\n    --ask-become-pass.\n  * become - become functionality has been migrated to a plugin architecture,\n    to allow customization of become functionality and 3rd party become methods\n    (https://github.com/ansible/ansible/pull/50991)\n\n- addresses CVE-2018-16859, CVE-2018-16876, CVE-2019-3828, CVE-2018-16837\n\nFor the full changelog see /usr/share/doc/packages/ansible/changelogs or online:\nhttps://github.com/ansible/ansible/blob/stable-2.8/changelogs/CHANGELOG-v2.8.rst\n\n","title":"Description of the patch"},{"category":"details","text":"openSUSE-2019-1635","title":"Patchnames"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"SUSE ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"self","summary":"URL of this CSAF notice","url":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1635-1.json"},{"category":"self","summary":"URL for openSUSE-SU-2019:1635-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY/#CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY"},{"category":"self","summary":"E-Mail link for openSUSE-SU-2019:1635-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY/#CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY"},{"category":"self","summary":"SUSE Bug 1109957","url":"https://bugzilla.suse.com/1109957"},{"category":"self","summary":"SUSE Bug 1112959","url":"https://bugzilla.suse.com/1112959"},{"category":"self","summary":"SUSE Bug 1118896","url":"https://bugzilla.suse.com/1118896"},{"category":"self","summary":"SUSE Bug 1126503","url":"https://bugzilla.suse.com/1126503"},{"category":"self","summary":"SUSE CVE CVE-2018-16837 page","url":"https://www.suse.com/security/cve/CVE-2018-16837/"},{"category":"self","summary":"SUSE CVE CVE-2018-16859 page","url":"https://www.suse.com/security/cve/CVE-2018-16859/"},{"category":"self","summary":"SUSE CVE CVE-2018-16876 page","url":"https://www.suse.com/security/cve/CVE-2018-16876/"},{"category":"self","summary":"SUSE CVE CVE-2019-3828 page","url":"https://www.suse.com/security/cve/CVE-2019-3828/"}],"title":"Security update for ansible","tracking":{"current_release_date":"2019-06-27T05:50:47Z","generator":{"date":"2019-06-27T05:50:47Z","engine":{"name":"cve-database.git:bin/generate-csaf.pl","version":"1"}},"id":"openSUSE-SU-2019:1635-1","initial_release_date":"2019-06-27T05:50:47Z","revision_history":[{"date":"2019-06-27T05:50:47Z","number":"1","summary":"Current version"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_version","name":"ansible-2.8.1-bp150.3.9.1.noarch","product":{"name":"ansible-2.8.1-bp150.3.9.1.noarch","product_id":"ansible-2.8.1-bp150.3.9.1.noarch"}}],"category":"architecture","name":"noarch"},{"branches":[{"category":"product_name","name":"SUSE Package Hub 12","product":{"name":"SUSE Package Hub 12","product_id":"SUSE Package Hub 12","product_identification_helper":{"cpe":"cpe:/o:suse:packagehub:12"}}},{"category":"product_name","name":"SUSE Package Hub 15","product":{"name":"SUSE Package Hub 15","product_id":"SUSE Package Hub 15"}},{"category":"product_name","name":"openSUSE Leap 15.0","product":{"name":"openSUSE Leap 15.0","product_id":"openSUSE Leap 15.0","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.0"}}},{"category":"product_name","name":"openSUSE Leap 15.1","product":{"name":"openSUSE Leap 15.1","product_id":"openSUSE Leap 15.1","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.1"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"ansible-2.8.1-bp150.3.9.1.noarch as component of SUSE Package Hub 12","product_id":"SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch"},"product_reference":"ansible-2.8.1-bp150.3.9.1.noarch","relates_to_product_reference":"SUSE Package Hub 12"},{"category":"default_component_of","full_product_name":{"name":"ansible-2.8.1-bp150.3.9.1.noarch as component of SUSE Package Hub 15","product_id":"SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch"},"product_reference":"ansible-2.8.1-bp150.3.9.1.noarch","relates_to_product_reference":"SUSE Package Hub 15"},{"category":"default_component_of","full_product_name":{"name":"ansible-2.8.1-bp150.3.9.1.noarch as component of openSUSE Leap 15.0","product_id":"openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch"},"product_reference":"ansible-2.8.1-bp150.3.9.1.noarch","relates_to_product_reference":"openSUSE Leap 15.0"},{"category":"default_component_of","full_product_name":{"name":"ansible-2.8.1-bp150.3.9.1.noarch as component of openSUSE Leap 15.1","product_id":"openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"},"product_reference":"ansible-2.8.1-bp150.3.9.1.noarch","relates_to_product_reference":"openSUSE Leap 15.1"}]},"vulnerabilities":[{"cve":"CVE-2018-16837","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2018-16837"}],"notes":[{"category":"general","text":"Ansible \"User\" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.","title":"CVE description"}],"product_status":{"recommended":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]},"references":[{"category":"external","summary":"CVE-2018-16837","url":"https://www.suse.com/security/cve/CVE-2018-16837"},{"category":"external","summary":"SUSE Bug 1112959 for CVE-2018-16837","url":"https://bugzilla.suse.com/1112959"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"products":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"threats":[{"category":"impact","date":"2019-06-27T05:50:47Z","details":"important"}],"title":"CVE-2018-16837"},{"cve":"CVE-2018-16859","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2018-16859"}],"notes":[{"category":"general","text":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.","title":"CVE description"}],"product_status":{"recommended":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]},"references":[{"category":"external","summary":"CVE-2018-16859","url":"https://www.suse.com/security/cve/CVE-2018-16859"},{"category":"external","summary":"SUSE Bug 1109957 for CVE-2018-16859","url":"https://bugzilla.suse.com/1109957"},{"category":"external","summary":"SUSE Bug 1116587 for CVE-2018-16859","url":"https://bugzilla.suse.com/1116587"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.0"},"products":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"threats":[{"category":"impact","date":"2019-06-27T05:50:47Z","details":"moderate"}],"title":"CVE-2018-16859"},{"cve":"CVE-2018-16876","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2018-16876"}],"notes":[{"category":"general","text":"ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.","title":"CVE description"}],"product_status":{"recommended":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]},"references":[{"category":"external","summary":"CVE-2018-16876","url":"https://www.suse.com/security/cve/CVE-2018-16876"},{"category":"external","summary":"SUSE Bug 1109957 for CVE-2018-16876","url":"https://bugzilla.suse.com/1109957"},{"category":"external","summary":"SUSE Bug 1118896 for CVE-2018-16876","url":"https://bugzilla.suse.com/1118896"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"products":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"threats":[{"category":"impact","date":"2019-06-27T05:50:47Z","details":"low"}],"title":"CVE-2018-16876"},{"cve":"CVE-2019-3828","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2019-3828"}],"notes":[{"category":"general","text":"Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.","title":"CVE description"}],"product_status":{"recommended":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]},"references":[{"category":"external","summary":"CVE-2019-3828","url":"https://www.suse.com/security/cve/CVE-2019-3828"},{"category":"external","summary":"SUSE Bug 1126503 for CVE-2019-3828","url":"https://bugzilla.suse.com/1126503"},{"category":"external","summary":"SUSE Bug 1164137 for CVE-2019-3828","url":"https://bugzilla.suse.com/1164137"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.0"},"products":["SUSE Package Hub 12:ansible-2.8.1-bp150.3.9.1.noarch","SUSE Package Hub 15:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.0:ansible-2.8.1-bp150.3.9.1.noarch","openSUSE Leap 15.1:ansible-2.8.1-bp150.3.9.1.noarch"]}],"threats":[{"category":"impact","date":"2019-06-27T05:50:47Z","details":"moderate"}],"title":"CVE-2019-3828"}]}