Security update for ansible SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2274-1 Final 1 1 2019-09-03T13:06:02Z current 2019-09-03T13:06:02Z 2019-09-03T13:06:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ansible This update for ansible fixes the following issues: Security issue fixed: - CVE-2019-10206: Fixed ansible cli tools that prompt passwords by expanding them from templates as they could contain special characters (bsc#1142690). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-2274,SUSE-2019-2274,SUSE-OpenStack-Cloud-8-2019-2274,SUSE-OpenStack-Cloud-Crowbar-8-2019-2274 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192274-1/ Link for SUSE-SU-2019:2274-1 https://lists.suse.com/pipermail/sle-security-updates/2019-September/005874.html E-Mail link for SUSE-SU-2019:2274-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1142690 SUSE Bug 1142690 https://www.suse.com/security/cve/CVE-2019-10206/ SUSE CVE CVE-2019-10206 page HPE Helion OpenStack 8 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud Crowbar 8 ansible-2.4.6.0-3.6.1 ansible-2.4.6.0-3.6.1 as a component of HPE Helion OpenStack 8 ansible-2.4.6.0-3.6.1 as a component of SUSE OpenStack Cloud 8 ansible-2.4.6.0-3.6.1 as a component of SUSE OpenStack Cloud Crowbar 8 ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. CVE-2019-10206 HPE Helion OpenStack 8:ansible-2.4.6.0-3.6.1 SUSE OpenStack Cloud 8:ansible-2.4.6.0-3.6.1 SUSE OpenStack Cloud Crowbar 8:ansible-2.4.6.0-3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192274-1/ https://www.suse.com/security/cve/CVE-2019-10206.html CVE-2019-10206 https://bugzilla.suse.com/1142690 SUSE Bug 1142690 https://bugzilla.suse.com/1154232 SUSE Bug 1154232