Bug 475602 – <app-admin/ansible-1.2.1: Not caching SSH host keys (CVE-2013-2233)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-07-03 09:05:10 UTC]

From ${URL} :

http://www.ansibleworks.com/

Problem:
Default configuration does not cache SSH host keys, effectively disabling
host key checking

Note - do not credit me for finding this, I'm just the only person
indignant enough to request a CVE

A colleague found this bug, only to notice that it was logged by somebody
else (antong on github), and rejected:
https://github.com/ansible/ansible/issues/857

This can be fixed by calling ssh.load_system_host_keys() after line 78 of
https://github.com/ansible/ansible/blob/496f06c3c90cfd89802622c640480328436746c6/lib/ansible/runner/connection_plugins/paramiko_ssh.py

While it is possible to call the SSH command instead of using paramiko,
this isn't the default and the ramifications of not checking host keys
aren't advertised to users.  A more reasonable approach would be to
document how to un-cache a host key should it change.



@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.

[Comment 1 Chris Reffett (RETIRED) 2013-07-04 00:26:43 UTC]

Upstream report [1] says that a 1.2.1 release fixing this is expected to be released tomorrow.

[1] https://groups.google.com/forum/#!msg/ansible-project/OuHJwG0LLTY/qp95qAq-PNUJ

[Comment 2 Sergey Popov 2013-07-15 10:53:01 UTC]

*** Bug 476872 has been marked as a duplicate of this bug. ***

[Comment 3 Sergey Popov 2013-07-16 12:25:00 UTC]

+  16 Jul 2013; Sergey Popov <[e-mail]> +ansible-1.2.1.ebuild,
+  ansible-9999.ebuild:
+  Version bump, wrt bug #475602. Remove examples USE-flag due to upstream
+  changes. Sync live ebuild

Arches, please test and mark stable =app-admin/ansible-1.2.1

Target keywords: amd64 x86

[Comment 4 Agostino Sarubbo 2013-07-20 10:16:38 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2013-07-20 10:17:09 UTC]

x86 stable

[Comment 6 Chris Reffett (RETIRED) 2013-07-20 11:39:24 UTC]

All done stabling. GLSA?

[Comment 7 Sergey Popov 2013-08-22 12:55:13 UTC]

GLSA vote: no

[Comment 8 Chris Reffett (RETIRED) 2013-08-23 13:33:04 UTC]

GLSA vote: no. Closing noglsa.

[Comment 9 Chris Reffett (RETIRED) 2013-08-23 13:35:38 UTC]

Oops, wait a second. @maintainers: please remove affected ebuilds.

[Comment 10 Sergey Popov 2013-08-24 05:23:09 UTC]

+  24 Aug 2013; Sergey Popov <[e-mail]> -ansible-1.0.ebuild,
+  -ansible-1.1.ebuild:
+  Drop vulnerable versions, wrt bug #475602