Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[2.8] CVE-2020-1746 - Remove the params module option from ldap_attr and ldap_entry #68715

Merged
merged 5 commits into from Apr 15, 2020
Merged

[2.8] CVE-2020-1746 - Remove the params module option from ldap_attr and ldap_entry #68715

merged 5 commits into from Apr 15, 2020

Commits on Apr 6, 2020

  1. Remove the params module option from ldap_attr and ldap_entry 

    Module options that circumvent Ansible's option handling were disallowed
in:
https://meetbot.fedoraproject.org/ansible-meeting/2017-09-28/ansible_dev_meeting.2017-09-28-15.00.log.html

Additionally, this particular usage can be insecure if bind_pw is set
this way as the password could end up in a logfile or displayed on
stdout.

Fixes CVE-2020-1746

(cherry picked from commit 0ff609f)
    @abadger @s-hertel
    abadger authored and s-hertel committed Apr 6, 2020
    Configuration menu
    Copy the full SHA
    425debf View commit details
    Browse the repository at this point in the history

  2. Fix formatting for option names 

    Co-Authored-By: Felix Fontein <felix@fontein.de>
    @s-hertel @felixfontein
    s-hertel and felixfontein committed Apr 6, 2020
    Configuration menu
    Copy the full SHA
    fdc45f4 View commit details
    Browse the repository at this point in the history

  3. Fix fail_json

    @s-hertel
    s-hertel committed Apr 6, 2020
    Configuration menu
    Copy the full SHA
    1c66b5b View commit details
    Browse the repository at this point in the history

  4. update sanity

    @s-hertel
    s-hertel committed Apr 6, 2020
    Configuration menu
    Copy the full SHA
    39b8526 View commit details
    Browse the repository at this point in the history

Commits on Apr 9, 2020

  1. fix indentation error

    @s-hertel
    s-hertel committed Apr 9, 2020
    Configuration menu
    Copy the full SHA
    33a1dc4 View commit details
    Browse the repository at this point in the history