FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  456043
Date:      2017-12-11
Time:      14:53:31Z
Committer: tijl

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
15a04b9f-47cb-11e7-a853-001fbc0f280fansible -- Input validation flaw in jinja2 templating system

RedHat security team reports:

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, result in code execution.

Discovery 2017-05-09
Entry 2017-06-02
lt 2.3.1
253c6889-06f0-11e6-925f-6805ca0b3d42ansible -- use of predictable paths in lxc_container

Ansible developers report:

CVE-2016-3096: do not use predictable paths in lxc_container

  • do not use a predictable filename for the LXC attach script
  • don't use predictable filenames for LXC attach script logging
  • don't set a predictable archive_path

this should prevent symlink attacks which could result in

  • data corruption
  • data leakage
  • privilege escalation

Discovery 2016-04-02
Entry 2016-04-20
ge lt

lt 1.9.6

2c493ac8-205e-11e5-a4a5-002590263bf5ansible -- remote code execution vulnerability

Ansible, Inc. reports:

Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4

Discovery 2014-06-25
Entry 2015-07-02
lt 1.6.4

478d4102-2319-4026-b3b2-a57c48f159acansible -- information disclosure flaw

ansible developers report:

Ansible versions 2.2.3 and earlier are vulnerable to an information disclosure flaw due to the interaction of call back plugins and the no_log directive where the information may not be sanitized properly.

Discovery 2017-07-21
Entry 2017-09-25
le 2.2.3
72fccfdf-2061-11e5-a4a5-002590263bf5ansible -- multiple vulnerabilities

Ansible, Inc. reports:

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

Discovery 2015-06-25
Entry 2015-07-02
Modified 2015-08-18
lt 1.9.2

9dae9d62-205f-11e5-a4a5-002590263bf5ansible -- code execution from compromised remote host data or untrusted local data

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or untrusted local data - resolved in Ansible 1.6.7

Discovery 2014-07-21
Entry 2015-07-02
lt 1.6.7

a478421e-2059-11e5-a4a5-002590263bf5ansible -- enable host key checking in paramiko connection type

Ansible changelog reports:

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

Discovery 2012-08-13
Entry 2015-07-02
lt 1.2.1

a6a9f9d5-205c-11e5-a4a5-002590263bf5ansible -- local symlink exploits

MITRE reports:

runner/connection_plugins/ in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

lib/ansible/playbook/ in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.

Discovery 2013-08-21
Entry 2015-07-02
lt 1.2.3

a93c3287-d8fd-11e6-be5c-001fbc0f280fAnsible -- Command execution on Ansible controller from host

Computest reports:

Computest found and exploited several issues that allow a compromised host to execute commands on the Ansible controller and thus gain access to other hosts controlled by that controller.

Discovery 2017-01-09
Entry 2017-01-12
gt 1.9.6_1 lt

e308c61a-2060-11e5-a4a5-002590263bf5ansible -- multiple vulnerabilities

Ansible, Inc. reports:

Arbitrary execution from data from compromised remote hosts or local data when using a legacy Ansible syntax - resolved in Ansible 1.7

ansible-galaxy command when used on local tarballs (and not can install a malformed tarball if so provided - resolved in Ansible 1.7

Discovery 2014-08-06
Entry 2015-07-02
lt 1.7