ansible: CVE-2019-10156: templating causing an unexpected key file to be set on a remote node

Debian Bug report logs - #930065
ansible: CVE-2019-10156: templating causing an unexpected key file to be set on a remote node

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ansible: CVE-2019-10156: templating causing an unexpected key file to be set on a remote node

Date: Thu, 06 Jun 2019 14:16:25 +0200

Source: ansible
Severity: important
Tags: security upstream
Forwarded: https://github.com/ansible/ansible/pull/57188

Hi,

The following vulnerability was published for ansible, can you check
for which Debian versions this is relevant and adjust the found
versions?

CVE-2019-10156[0]:
templating causing an unexpected key file to be set on remote node

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-10156
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10156
[1] https://github.com/ansible/ansible/pull/57188

Regards,
Salvatore

Message #12 received at submit@bugs.debian.org (full text, mbox, reply):

From: Lee Garrett <debian@rocketjump.eu>

To: Salvatore Bonaccorso <carnil@debian.org>, 930065@bugs.debian.org, Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#930065: ansible: CVE-2019-10156: templating causing an unexpected key file to be set on a remote node

Date: Fri, 14 Jun 2019 15:52:45 +0200

Hi,

the updated pull request now also contains tests, which made it easier
for me to reproduce the issue. I will prepare an update for sid on
Sunday/Monday, and evaluate if this also applies for stable. AFAICS this
has a low impact, as it requires an attacker to provide the template
files (or a user to write faulty templates and not verify the output),
which already has grave security implications by itself.

Then again the RH bug tracker hints that it might be used to leak
passwords [0] (through the authorized_key module?), though the pull
request does not contain any changes there. Information on this CVE is
unfortunately rather vague.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=1717311

Regards,
Lee

On 06/06/2019 14:16, Salvatore Bonaccorso wrote:
> Source: ansible
> Severity: important
> Tags: security upstream
> Forwarded: https://github.com/ansible/ansible/pull/57188
> 
> Hi,
> 
> The following vulnerability was published for ansible, can you check
> for which Debian versions this is relevant and adjust the found
> versions?
> 
> CVE-2019-10156[0]:
> templating causing an unexpected key file to be set on remote node
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-10156
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10156
> [1] https://github.com/ansible/ansible/pull/57188
> 
> Regards,
> Salvatore
> 

Message #26 received at 930065@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Lee Garrett <debian@rocketjump.eu>, 930065@bugs.debian.org

Subject: Re: Bug#930065: ansible: CVE-2019-10156: templating causing an unexpected key file to be set on a remote node

Date: Fri, 14 Jun 2019 21:07:44 +0200

Hi Lee,

On Fri, Jun 14, 2019 at 03:52:45PM +0200, Lee Garrett wrote:
> Hi,
> 
> the updated pull request now also contains tests, which made it easier
> for me to reproduce the issue. I will prepare an update for sid on
> Sunday/Monday, and evaluate if this also applies for stable. AFAICS this
> has a low impact, as it requires an attacker to provide the template
> files (or a user to write faulty templates and not verify the output),
> which already has grave security implications by itself.
> 
> Then again the RH bug tracker hints that it might be used to leak
> passwords [0] (through the authorized_key module?), though the pull
> request does not contain any changes there. Information on this CVE is
> unfortunately rather vague.

Thanks for looking into and your assessment. So in case it affects
stable as well I guess we can safely mark it no-dsa and schedule a fix
via an upcoming point release.

For sid/buster, please keep in mind that the last date for requesting
unblocks is approaching quickly, so if you can fix it for buster that
would be great.

OTOH, I see there is 2.7.7+dfsg-1 and a newer upstream version
2.7.8+dfsg-1 in sid, so a targeted fix via testing-proposed-updates
would be needed for buster.

Regards,
Salvatore

Send a report that this bug log contains spam.