Re-add changelogs and add docs for CVE-2020-1736 reverts [2.8] #71516
Conversation
Signed-off-by: Rick Elrod <rick@elrod.me>
Signed-off-by: Rick Elrod <rick@elrod.me>
ansibot
added
affects_2.8
| @@ -373,6 +373,12 @@ add ``$ErrorActionPreference = "Continue"`` to the top of the module. This chang | |||
| of the EAP that was accidentally removed in a previous release and ensure that modules are more resilient to errors | |||
| that may occur in execution. | |||
|
|
|||
| * Version 2.8.14 of Ansible changed the default mode of file-based tasks to ``0o600`` when the user did not specify a ``mode`` parameter on file-based tasks. This was in response to a CVE report which we have reconsidered and no longer consider a flaw in Ansible. As a result, the ``mode`` change has been reverted in 2.8.15, and ``mode`` will now default to ``0o666`` as in previous versions of Ansible. | |||
| * Affected modules included known_hosts, service, authorized_key, interfaces_file, pam_limits, pamd, redhat_subscription, selinux, and sysctrl. If you are using Ansible 2.8.14 and seeing new failures in these modules, upgrade to 2.8.15. | |||
There was a problem hiding this comment.
This list is not complete. We should either list all the modules that call atomic_move, or list none of them.
sysctrl --> sysctl
There was a problem hiding this comment.
Here are the modules in stable-2.8 that call atomic_move():
apt_repository
assemble
authorized_key
basics/get_url
blockinfile
copy
ini_file
interfaces_file
jenkins_plugin
known_hosts
lineinfile
openssl_dhparam
pam_limits
pamd
redhat_subscription
replace
selinux
service
sysctl
There was a problem hiding this comment.
Of course, providing this last may or may not lead to more confusion since most of them don't accept mode. 😞
There was a problem hiding this comment.
I originally didn't list them but @acozine thought it would be helpful. I'm happy with either approach.
There was a problem hiding this comment.
I listed the ones that were in the original porting guide entry. We can leave that out, since it seems likely to do more harm than good.
There was a problem hiding this comment.
@samdoran, I didn't realize there were other affected modules. How about the suggestion below?
Co-authored-by: Sam Doran <sdoran@redhat.com>
Co-authored-by: Alicia Cozine <879121+acozine@users.noreply.github.com>
SUMMARY
Same as #71515
ISSUE TYPE
COMPONENT NAME
docs