4 ms·

RedHat Ansible High-Risk Vulnerability

39 points by fapjacks 10y ago

SFJulie 10y ago
It has a smell of Shellshock. The interpretation of variable passed for flexibility that resulted in a huge whack a mole of bash. 2 years later shellshock is not officially fixed. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-71...
ivank 10y ago
https://news.ycombinator.com/item?id=13380809 https://news.ycombinator.com/item?id=13380809
fapjacks 10y ago
There is some interesting discussion in this LWN subscriber link (https://lwn.net/SubscriberLink/711791/5109edb099f55603/ https://lwn.net/SubscriberLink/711791/5109edb099f55603/). I'm not sure about posting subscriber-only links, but this was pasted in a well-trafficked IRC channel on Freenode, and LWN seems to want these links spread far and wide as long as it isn't used to subvert their subscription model.
lobo_tuerto 10y ago
If someone was moving away from Ansible, what would be the best option(s) to consider?
- VonGuard 10y ago
  Puppet, Chef, Salt, BCFG2?
- fapjacks 10y ago
  What's the motivation for moving away from Ansible? Just wondering. Puppet and Chef are enormous and brittle in my experience. I've moved previously from Puppet to Chef, and then from Chef to Ansible. I tried Saltstack but it felt similar to Puppet and Chef. Ansible can be slow, but the complexity overhead is minimal comparatively.
- lucd 10y ago
  You may also consider CFEngine. Each solution has its forces and weaknesses, what will you be using it for ?
  - lobo_tuerto 10y ago
    I was asking just out of curiosity. I'm not really an Ansible user, but I was looking forward to learn it as part of my own devops education stuff.
- frik 10y ago
  Ideally, I would prefer a similar software written in a C syntax style script language like JavaScript/NodeJS or PHP, or Lua.
rarrrrrr 10y ago
Odd. I reported this very same form of vulnerability to the Ansible team in the 1.5.4 series in 2014, where the code basically eval'd the "facts" discovered from a system under management. There was this "safe_eval" function which filtered input in a way quite inconsistent with its name. The Ansible team was responsive and pleasant to work with. https://groups.google.com/forum/#!topic/ansible-project/MUQxiKwSQDc https://groups.google.com/forum/#!topic/ansible-project/MUQx... But I suspect lots of remote control and monitoring software products might have security bugs like this where they assume that the returned information from systems under management are trustworthy. Edit to add: Here's the patch made to safe_eval. I had suggested using literal_eval instead but I think they didn't want to require Python 2.6+. https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c https://github.com/ansible/ansible/commit/998793fd0ab55705d5...

39 points by fapjacks 10y ago

It has a smell of Shellshock. The interpretation of variable passed for flexibility that resulted in a huge whack a mole of bash. 2 years later shellshock is not officially fixed. https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-71...

ivank 10y ago

https://news.ycombinator.com/item?id=13380809 https://news.ycombinator.com/item?id=13380809

fapjacks 10y ago

There is some interesting discussion in this LWN subscriber link (https://lwn.net/SubscriberLink/711791/5109edb099f55603/ https://lwn.net/SubscriberLink/711791/5109edb099f55603/). I'm not sure about posting subscriber-only links, but this was pasted in a well-trafficked IRC channel on Freenode, and LWN seems to want these links spread far and wide as long as it isn't used to subvert their subscription model.

lobo_tuerto 10y ago

If someone was moving away from Ansible, what would be the best option(s) to consider?

VonGuard 10y ago
Puppet, Chef, Salt, BCFG2?
fapjacks 10y ago
What's the motivation for moving away from Ansible? Just wondering. Puppet and Chef are enormous and brittle in my experience. I've moved previously from Puppet to Chef, and then from Chef to Ansible. I tried Saltstack but it felt similar to Puppet and Chef. Ansible can be slow, but the complexity overhead is minimal comparatively.
lucd 10y ago
You may also consider CFEngine. Each solution has its forces and weaknesses, what will you be using it for ?
- lobo_tuerto 10y ago
  I was asking just out of curiosity. I'm not really an Ansible user, but I was looking forward to learn it as part of my own devops education stuff.
frik 10y ago
Ideally, I would prefer a similar software written in a C syntax style script language like JavaScript/NodeJS or PHP, or Lua.

rarrrrrr 10y ago

Odd. I reported this very same form of vulnerability to the Ansible team in the 1.5.4 series in 2014, where the code basically eval'd the "facts" discovered from a system under management. There was this "safe_eval" function which filtered input in a way quite inconsistent with its name. The Ansible team was responsive and pleasant to work with. https://groups.google.com/forum/#!topic/ansible-project/MUQxiKwSQDc https://groups.google.com/forum/#!topic/ansible-project/MUQx... But I suspect lots of remote control and monitoring software products might have security bugs like this where they assume that the returned information from systems under management are trustworthy. Edit to add: Here's the patch made to safe_eval. I had suggested using literal_eval instead but I think they didn't want to require Python 2.6+. https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c https://github.com/ansible/ansible/commit/998793fd0ab55705d5...