618202 – (CVE-2017-7481) <app-admin/ansible-2.3.0.0-r1: Security issue with lookup return not tainting the jinja2 environment

Bug 618202 (CVE-2017-7481) - <app-admin/ansible-2.3.0.0-r1: Security issue with lookup return not tainting the jinja2 environment

Summary: <app-admin/ansible-2.3.0.0-r1: Security issue with lookup return not tainting...

Status:	RESOLVED FIXED

Alias:	CVE-2017-7481

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.redhat.com/show_bug....
Whiteboard:	B3 [noglsa cve cleanup]
Keywords:

Depends on:
Blocks:

Reported:	2017-05-11 15:24 UTC by Agostino Sarubbo
Modified:	2017-05-22 02:21 UTC (History)
CC List:	4 users (show)

See Also:
Package list:	=app-admin/ansible-2.3.0.0-r1 amd64 x86
Runtime testing required:	---

Flags:	stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2017-05-11 15:24:20 UTC

From ${URL} :

Data for lookup plugins used as variables was not being correctly marked as "unsafe", then some secrets could be printed out.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Matthew Thode ( prometheanfire ) archtester

2017-05-11 15:46:10 UTC

I haven't seen a new release yet (get auto tasked with packaging it when it occurs), but I generally package it within a day.  I'll keep an eye out though.

Comment 2 Matthew Thode ( prometheanfire ) archtester

2017-05-18 16:23:46 UTC

fixed in 2.3.0.0-r1, arches, please fast stabilize it, I'll clean the old once that's done.

Comment 3 Agostino Sarubbo gentoo-dev

2017-05-20 08:49:36 UTC

amd64 stable

Comment 4 Agostino Sarubbo gentoo-dev

2017-05-20 09:35:49 UTC

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

Comment 5 Matthew Thode ( prometheanfire ) archtester

2017-05-20 21:31:18 UTC

cleaned up

Comment 6 Yury German Gentoo Infrastructure

2017-05-22 02:21:49 UTC

GLSA Vote: No

Thank you all for you work. 
Closing as [noglsa].