Ansible 2.16.19 Fixes Security Vulnerability in Galaxy
securityinfraengineer
patch security
Ansible version 2.16.19 addresses a security vulnerability in `ansible-galaxy install` where malicious role authors could inject arbitrary git configurations. This patch ensures role requirements are passed as positional arguments to `git clone`, mitigating the risk for users installing roles. The fix is available in this patch release.
Read the original announcement →
https://github.com/ansible/ansible/releases/tag/v2.16.19
Related releases
- Ansible 2.18.18 Security Fixes Ansible Core Releases ·
- Ansible v2.19.11 Security Fix and Bugfixes Ansible Core Releases ·
- Ansible Security Fixes and Bug Fixes in v2.20.7 Ansible Core Releases ·
- Ansible v2.21.1: Security Fixes and Bug Fixes Ansible Core Releases ·
- Ansible v2.21.2: Timeout callback and fact gathering fixes Ansible Core Releases ·