Date: Sat, 2 May 2015 08:54:10 -0500 From: James Cammarata <jcammarata@...ible.com> To: Michael Scherer <misc@...b.org> Cc: oss-security@...ts.openwall.com, security@...ible.com Subject: Re: CVE Request / Ansible: insecure permission on a directory when using spacewalk inventory Hi Michael, Thanks for finding this and fixing it, however we're not sure if this requires a CVE? First of all, the impacted script is an optional inventory script, which is not packaged with Ansible directly and must be downloaded from the source repository. Second, the script (as you mentioned) creates this directory typically in a relatively secure location, so the chances of it being exposed are greatly lessened. Also, this is a relatively under-utilized script, as not many people that we know of are getting host information from Spacewalk using this script. Finally, the data contained within that cache file is not very sensitive, and would typically only contain the host IP information of systems from Spacewalk. If a CVE is issued, we can mention it in the release, but we'd much rather simply fix this ASAP and include it in the next major/minor release of Ansible (2.0 and 1.9.2, respectively). Thanks! James Cammarata Director, Ansible Core Engineering github: jimi-c On Fri, May 1, 2015 at 10:54 PM, Michael Scherer <misc@...b.org> wrote: > Hi, > > Could a CVE be assigned for this problem : > > Ansible inventory script for spacewalk create a file in the current > directory with incorrect permission due to a error in a chmod > specification. > > > https://github.com/ansible/ansible/blob/devel/plugins/inventory/spacewalk.py#L63 > > In python, os.chmod need to be in octal, and 2755 is not octal. > So in the end, we manage to have permission like this : > > d-ws-w-rwt. > > And o+rw and u+s kinda sound bad. The directory is created in $PWD if > I read the code right, so that's likely the homedir of 1 admin. > However, that's executed locally, or from a bastion, so there > isn't much venue to attack ( even if shared shell server still exist > nowadays ), > and this requires to use spacewalk. > > I pushed a commit there : > > https://github.com/mscherer/ansible/commit/251197f11de7c7a3c5d81141970dd8f2ef16c0ee > > I will wait for a CVE to be assigned before fixing the commit message, and > push a > PR ( cause i am quite bothered when I cannot find the CVE in the commit > message) > > -- > Michael Scherer >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ