Ansible v2.21.1: Security Fixes and Bug Fixes
Ansible v2.21.1 addresses security vulnerabilities in ansible-galaxy and the psrp/winrm modules, preventing arbitrary code injection and sensitive log exposure. It also resolves several bugs, including issues with empty PAGER values, configuration injection settings, playbook execution with unreachable hosts, skipped meta actions, and command execution handling. These fixes are available now for all users.
- →Ansible Galaxy security fix prevents arbitrary code injection
- →Psrp and WinRM modules enhance security by not logging sensitive data
- →CLI handles empty PAGER values
- →Config correctly sets invocation injection
- →Free strategy fixes IndexError with unreachable hosts
Security (2) ›
- Ansible Galaxy security fix prevents arbitrary code injection
A security vulnerability in ansible-galaxy could allow a malicious role author to inject arbitrary git configuration in role dependencies. This has been fixed by ensuring role requirements are passed as positional arguments to `git clone`.
- Psrp and WinRM modules enhance security by not logging sensitive data
Psrp and winrm modules will no longer log raw stdout/stderr on verbosity 5 when a task has `no_log: true` set, preventing exposure of sensitive information.
Fixes (4) ›
- CLI handles empty PAGER values
The command-line interface now correctly handles empty values for the PAGER environment variable.
- Config correctly sets invocation injection
The correct key-value pair is now used for the inject_invocation setting in Ansible configurations.
- Free strategy fixes IndexError with unreachable hosts
A fix has been implemented for the free strategy to resolve an `IndexError` that occurred when hosts became unreachable during playbook execution.
- Meta pseudo-action callback dispatch restored
A regression affecting the `v2_runner_on_skipped` callback when meta actions were skipped has been fixed, ensuring callback dispatch is no longer omitted.
https://github.com/ansible/ansible/releases/tag/v2.21.1
Related releases
- Ansible 2.16.19 Fixes Security Vulnerability in Galaxy Ansible Core Releases ·
- Ansible 2.18.18 Security Fixes Ansible Core Releases ·
- Ansible v2.19.11 Security Fix and Bugfixes Ansible Core Releases ·
- Ansible Security Fixes and Bug Fixes in v2.20.7 Ansible Core Releases ·
- Ansible v2.21.2: Timeout callback and fact gathering fixes Ansible Core Releases ·