Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Jun 2014 22:51:51 +0200
From: Florian Weimer <>
Subject: Re: Re: Ansible CVE requests

On 06/26/2014 08:18 PM, wrote:
> We think 998793fd0ab55705d57527a38cee5e83f535974c is about fixing one
> type of issue, but feel free to identify any additional types of
> issues that are also fixed. Use CVE-2014-4657 for the general topic of
> "the product intentionally allows code execution of code with limited
> capabilities, but the code restrictions are insufficient."
> suggests that this was fixed in 1.5.4.

It turns out that the fix was incomplete:

Upstream announcement:

I think this warrants a separate CVE ID.  There is some debate whether 
this actually crosses a security boundary, but upstream thinks it does, 
after some consideration.

Note that the subsequent commit looks extremely suspicious as far as the 
sandboxing is concerned:

I'll try to figure out what's going on.

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.