Bug#912297: ansible: CVE-2018-16837

2018-11-12 Thread Chris Lamb
Hi all, > - user module - do not pass ssh_key_passphrase on cmdline > (CVE-2018-16837) Just a heads-up that I've fixed CVE-2018-16837 (#912297) in jessie, pushed this to the "jessie" branch on Salsa and tagged it as "debian/1.7.2+dfsg-2+deb8u1". Regards, -- ,''`. : :'

Bug#912297: ansible: CVE-2018-16837

2018-11-11 Thread Moritz Mühlenhoff
On Sun, Nov 11, 2018 at 12:15:52AM +0100, Lee Garrett wrote: > Quick follow-up: I don't have a patch for CVE-2018-10875. However, the patch > in question I have is for CVE-2018-10855, which is already checked in on the > stretch branch of the packaging repo. > > For some reason the security tracke

Bug#912297: ansible: CVE-2018-16837

2018-11-10 Thread Lee Garrett
Quick follow-up: I don't have a patch for CVE-2018-10875. However, the patch in question I have is for CVE-2018-10855, which is already checked in on the stretch branch of the packaging repo. For some reason the security tracker has this CVE marked as "not affected", although I could reproduce the

Bug#912297: ansible: CVE-2018-16837

2018-11-08 Thread Moritz Mühlenhoff
On Thu, Nov 08, 2018 at 11:51:49AM +0100, Lee Garrett wrote: > Hi, > > sorry for the late response. CVE-2018-16837 should be fairly straight-forward > to fix in stretch and jessie. > > For CVE-2018-10875 I have a patch in my work dir that should fix it. I'll push > it to the git stretch branch to

Bug#912297: ansible: CVE-2018-16837

2018-11-08 Thread Lee Garrett
Hi, sorry for the late response. CVE-2018-16837 should be fairly straight-forward to fix in stretch and jessie. For CVE-2018-10875 I have a patch in my work dir that should fix it. I'll push it to the git stretch branch tomorrow (not on my work machine right now). For CVE-2018-10874, it's not cl

Bug#912297: ansible: CVE-2018-16837

2018-11-07 Thread Chris Lamb
Hi Moritz, > > > From the upstream changelog for 2.7.1+dfsg-1 (already in unstable): > > [..] > > > - user module - do not pass ssh_key_passphrase on cmdline > > > (CVE-2018-16837) […] > We can fix that one in a DSA, but should also fix CVE-2018-10875 > and CVE-2018-10874, then. Cool. I will th

Bug#912297: ansible: CVE-2018-16837

2018-11-07 Thread Moritz Mühlenhoff
On Tue, Oct 30, 2018 at 12:35:05AM -0400, Chris Lamb wrote: > Hi Ivo, > > > From the upstream changelog for 2.7.1+dfsg-1 (already in unstable): > [..] > > - user module - do not pass ssh_key_passphrase on cmdline > > (CVE-2018-16837) > > Thanks for providing this and no problem that this wasn't

Bug#912297: ansible: CVE-2018-16837

2018-11-04 Thread Chris Lamb
Chris Lamb wrote: > Security team: This still affects stretch and jessie [unless] > I'm missing something - would you like me to prepare an upload for > stable? I'm happy to take the LTS side of things. Gentle ping on this? Regards, -- ,''`. : :' : Chris Lamb `. `'`

Bug#912297: ansible: CVE-2018-16837

2018-10-30 Thread Ivo De Decker
Hi Chris, On 10/30/2018 05:35 AM, Chris Lamb wrote: From the upstream changelog for 2.7.1+dfsg-1 (already in unstable): [..] - user module - do not pass ssh_key_passphrase on cmdline (CVE-2018-16837) Thanks for providing this and no problem that this wasn't in the changelog. Security te

Bug#912297: ansible: CVE-2018-16837

2018-10-29 Thread Chris Lamb
Hi Ivo, > From the upstream changelog for 2.7.1+dfsg-1 (already in unstable): [..] > - user module - do not pass ssh_key_passphrase on cmdline > (CVE-2018-16837) Thanks for providing this and no problem that this wasn't in the changelog. Security team: This still affects stretch and jessie as

Bug#912297: ansible: CVE-2018-16837

2018-10-29 Thread Chris Lamb
Package: ansible Version: 1.7.2+dfsg-2 X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for ansible. CVE-2018-16837[0]: | Ansible "User" module leaks any data which is passed on as a parameter | to ssh-keygen. This could lean in