Test ID:	1.3.6.1.4.1.25623.1.0.853113
Category:	SuSE Local Security Checks
Title:	openSUSE: Security Advisory for ansible (openSUSE-SU-2020:0513-1)
Summary:	The remote host is missing an update for the 'ansible'; package(s) announced via the openSUSE-SU-2020:0513-1 advisory.
Description:	Summary: The remote host is missing an update for the 'ansible' package(s) announced via the openSUSE-SU-2020:0513-1 advisory. Vulnerability Insight: This update for ansible to version 2.9.6 fixes the following issues: Security issues fixed: - CVE-2019-14904: Fixed a vulnerability in solaris_zone module via crafted solaris zone (boo#1157968). - CVE-2019-14905: Fixed an issue where malicious code could craft filename in nxos_file_copy module (boo#1157969). - CVE-2019-14864: Fixed Splunk and Sumologic callback plugins leak sensitive data in logs (boo#1154830). - CVE-2019-14846: Fixed secrets disclosure on logs due to display is hardcoded to DEBUG level (boo#1153452) - CVE-2019-14856: Fixed insufficient fix for CVE-2019-10206 (boo#1154232) - CVE-2019-14858: Fixed data in the sub parameter fields that will not be masked and will be displayed when run with increased verbosity (boo#1154231) - CVE-2019-10206: ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. (boo#1142690) - CVE-2019-10217: Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. (boo#1144453) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product: - openSUSE Leap 15.1: zypper in -t patch openSUSE-2020-513=1 Affected Software/OS: 'ansible' package(s) on openSUSE Leap 15.1. Solution: Please install the updated package(s). CVSS Score: 6.1 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-10206 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206 Debian Security Information: DSA-4950 (Google Search) https://www.debian.org/security/2021/dsa-4950 https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html SuSE Security Announcement: openSUSE-SU-2020:0513 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html SuSE Security Announcement: openSUSE-SU-2020:0523 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html Common Vulnerability Exposure (CVE) ID: CVE-2019-10217 Common Vulnerability Exposure (CVE) ID: CVE-2019-14846 https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html RedHat Security Advisories: RHSA-2019:3201 https://access.redhat.com/errata/RHSA-2019:3201 RedHat Security Advisories: RHSA-2019:3202 https://access.redhat.com/errata/RHSA-2019:3202 RedHat Security Advisories: RHSA-2019:3203 https://access.redhat.com/errata/RHSA-2019:3203 RedHat Security Advisories: RHSA-2019:3207 https://access.redhat.com/errata/RHSA-2019:3207 RedHat Security Advisories: RHSA-2020:0756 https://access.redhat.com/errata/RHSA-2020:0756 Common Vulnerability Exposure (CVE) ID: CVE-2019-14856 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14856 Common Vulnerability Exposure (CVE) ID: CVE-2019-14858 Common Vulnerability Exposure (CVE) ID: CVE-2019-14864 https://github.com/ansible/ansible/issues/63522 https://github.com/ansible/ansible/pull/63527 Common Vulnerability Exposure (CVE) ID: CVE-2019-14904 https://bugzilla.redhat.com/show_bug.cgi?id=1776944 https://github.com/ansible/ansible/pull/65686 Common Vulnerability Exposure (CVE) ID: CVE-2019-14905 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR/ RedHat Security Advisories: RHSA-2020:0216 https://access.redhat.com/errata/RHSA-2020:0216 RedHat Security Advisories: RHSA-2020:0218 https://access.redhat.com/errata/RHSA-2020:0218
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.