CVEs

Bug #1256068 reported by Michael Vogt
262
This bug affects 2 people
Affects Status Importance Assigned to Milestone
ansible (Ubuntu)
Expired
Undecided
Unassigned

Bug Description

The current version of ansible has various open security issues:

- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4259
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4260
- https://access.redhat.com/security/cve/CVE-2013-2233

I have no patches yet, need to dig through git for this first :/

Tags: patch
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Changed in ansible (Ubuntu):
status: New → Incomplete
Revision history for this message
Michael Vogt (mvo) wrote :

Sorry that this took so long.

I check the CVEs now and CVE-2013-4260 is not affecting 1.1.x as this is a problem with the ".retry" which is new feature in 1.2.

2013-4259 is pretty straightforward, I attached a patch.

2013-2233 is not straightforward at all, its essentially the diff between git tag v1.2 v1.2.1. There is no isolated diff or anything like this. I tried to isolate this, but I'm honestly not sure I was successful.

As it is it definitely needs some serious testing before it can go out to saucy-security. Pushing v1.2.3 out would be my prefered option TBH.

Revision history for this message
Michael Vogt (mvo) wrote :

Fwiw, this seems to be what fedora also did (just update the package instead of backporting the patch(es)).

tags: added: patch
Revision history for this message
anatoly techtonik (techtonik) wrote :

It is REALLY better to update the package to 1.4.

Revision history for this message
Michael Vogt (mvo) wrote :

@anatoly: yeah, 1.4.3 (or 1.4.4 even) is much nicer - however the policy is to not upgrade to new versions for security-updates.

Backporting patches is the prefered way. However in this particular case the backport is kind of invasive so I was wondering if going to the 1.2.3 version (which is the version that has a fix for these 3 CVEs) might be a good compromise between the potential erroneous backport of the "smart" protocol fix for CVE-2013-2333 and a new version.

Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for ansible (Ubuntu) because there has been no activity for 60 days.]

Changed in ansible (Ubuntu):
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.