From 64e2791092add32ba0ed5ab0b990c0f54ac519fb Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sun, 15 Dec 2019 21:12:20 +0100 Subject: ansible_2_7: 2.7.11 -> 2.7.15 This fixes the following security issues: * Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864) * CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG. If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG. This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH. This did not affect aws ansible modules as those are executed in a separate process. This has been fixed by switching to log level INFO * Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856) * properly hide parameters marked with no_log in suboptions when invalid parameters are passed to the module (CVE-2019-14858) * resolves CVE-2019-10206, by avoiding templating passwords from prompt as it is probable they have special characters. * Handle improper variable substitution that was happening in safe_eval, it was always meant to just do 'type enforcement' and have Jinja2 deal with all variable interpolation. Also see CVE-2019-10156 Changelog: https://github.com/ansible/ansible/blob/0623dedf2d9c4afc09e5be30d3ef249f9d1ebece/changelogs/CHANGELOG-v2.7.rst#v2-7-15 --- pkgs/tools/admin/ansible/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs') diff --git a/pkgs/tools/admin/ansible/default.nix b/pkgs/tools/admin/ansible/default.nix index eaba5225150..a78345916f2 100644 --- a/pkgs/tools/admin/ansible/default.nix +++ b/pkgs/tools/admin/ansible/default.nix @@ -7,11 +7,11 @@ ansible_2_7 = with python3Packages; toPythonApplication (ansible.overridePythonAttrs(old: rec { pname = "ansible"; - version = "2.7.11"; + version = "2.7.15"; src = fetchurl { url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz"; - sha256 = "0zipzm9al6k74h88b6zkddpcbxqs4cms7lidid6wn1vx3d3dxrp7"; + sha256 = "1kjqr35c11njyi3f2rjab6821bhqcrdykv4285q76gwv0qynigwr"; }; })); -- cgit 1.4.1 From 71cde971c7da86123b897d0e96a2e7bd88010df0 Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sun, 15 Dec 2019 21:18:13 +0100 Subject: ansible_2_8: 2.8.4 -> 2.8.7 This addresses the following security issues: * Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864) * CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG. If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG. This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH. This did not affect aws ansible modules as those are executed in a separate process. This has been fixed by switching to log level INFO * Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856) * properly hide parameters marked with no_log in suboptions when invalid parameters are passed to the module (CVE-2019-14858) Changelog: https://github.com/ansible/ansible/blob/24220a618a6d5cd3b5c99f8c7f7771661ed08d33/changelogs/CHANGELOG-v2.8.rst --- pkgs/development/python-modules/ansible/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs') diff --git a/pkgs/development/python-modules/ansible/default.nix b/pkgs/development/python-modules/ansible/default.nix index 74775cf756f..96be51e82f0 100644 --- a/pkgs/development/python-modules/ansible/default.nix +++ b/pkgs/development/python-modules/ansible/default.nix @@ -18,13 +18,13 @@ buildPythonPackage rec { pname = "ansible"; - version = "2.8.4"; + version = "2.8.7"; src = fetchFromGitHub { owner = "ansible"; repo = "ansible"; rev = "v${version}"; - sha256 = "1fp7zz8awfv70nn8i6x0ggx4472377hm7787x16qv2kz4nb069ki"; + sha256 = "08vqjk85j0g1x0iad03d7ysws433dikii8j2lr3a1mlx6d186vv8"; }; prePatch = '' -- cgit 1.4.1 From b21b92947e931bd40a5144c686510320fba6c88d Mon Sep 17 00:00:00 2001 From: Andreas Rammhold Date: Sun, 15 Dec 2019 21:22:30 +0100 Subject: ansible_2_6: 2.6.17 -> 2.6.20 This addresses the following security issues: * CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG. If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG. This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH. This did not affect aws ansible modules as those are executed in a separate process. This has been fixed by switching to log level INFO * Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856) * properly hide parameters marked with no_log in suboptions when invalid parameters are passed to the module (CVE-2019-14858) * resolves CVE-2019-10206, by avoiding templating passwords from prompt as it is probable they have special characters. * Handle improper variable substitution that was happening in safe_eval, it was always meant to just do 'type enforcement' and have Jinja2 deal with all variable interpolation. Also see CVE-2019-10156 Changelog: https://github.com/ansible/ansible/blob/9bdb89f740a87bcf760424577ce18a8f68d7a741/changelogs/CHANGELOG-v2.6.rst --- pkgs/tools/admin/ansible/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'pkgs') diff --git a/pkgs/tools/admin/ansible/default.nix b/pkgs/tools/admin/ansible/default.nix index a78345916f2..5b724fb0bf9 100644 --- a/pkgs/tools/admin/ansible/default.nix +++ b/pkgs/tools/admin/ansible/default.nix @@ -17,11 +17,11 @@ ansible_2_6 = with python3Packages; toPythonApplication (ansible.overridePythonAttrs(old: rec { pname = "ansible"; - version = "2.6.17"; + version = "2.6.20"; src = fetchurl { url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz"; - sha256 = "0ixr3g1nb02xblqyk87bzag8sj8phy37m24xflabfl1k2zfh0313"; + sha256 = "02ra9q2mifyawn0719y78wrbqzik73aymlzwi90fq71jgyfvkkqn"; }; })); } -- cgit 1.4.1