[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53AC87E7.1080009@redhat.com>
Date: Thu, 26 Jun 2014 22:51:51 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com, misc@...b.org
CC: cve-assign@...re.org
Subject: Re: Re: Ansible CVE requests
On 06/26/2014 08:18 PM, cve-assign@...re.org wrote:
> We think 998793fd0ab55705d57527a38cee5e83f535974c is about fixing one
> type of issue, but feel free to identify any additional types of
> issues that are also fixed. Use CVE-2014-4657 for the general topic of
> "the product intentionally allows code execution of code with limited
> capabilities, but the code restrictions are insufficient."
> https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
> suggests that this was fixed in 1.5.4.
It turns out that the fix was incomplete:
https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff0
Upstream announcement:
https://groups.google.com/forum/?_escaped_fragment_=msg/ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ
I think this warrants a separate CVE ID. There is some debate whether
this actually crosses a security boundary, but upstream thinks it does,
after some consideration.
Note that the subsequent commit looks extremely suspicious as far as the
sandboxing is concerned:
https://github.com/ansible/ansible/commit/35368e531b36c800ff6e61fc79fcd9
I'll try to figure out what's going on.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
