Date: Thu, 26 Jun 2014 22:51:51 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com, misc@...b.org CC: cve-assign@...re.org Subject: Re: Re: Ansible CVE requests On 06/26/2014 08:18 PM, cve-assign@...re.org wrote: > We think 998793fd0ab55705d57527a38cee5e83f535974c is about fixing one > type of issue, but feel free to identify any additional types of > issues that are also fixed. Use CVE-2014-4657 for the general topic of > "the product intentionally allows code execution of code with limited > capabilities, but the code restrictions are insufficient." > https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md > suggests that this was fixed in 1.5.4. It turns out that the fix was incomplete: https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff0 Upstream announcement: https://groups.google.com/forum/?_escaped_fragment_=msg/ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ I think this warrants a separate CVE ID. There is some debate whether this actually crosses a security boundary, but upstream thinks it does, after some consideration. Note that the subsequent commit looks extremely suspicious as far as the sandboxing is concerned: https://github.com/ansible/ansible/commit/35368e531b36c800ff6e61fc79fcd9 I'll try to figure out what's going on. -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.