Re: CVE Request / Ansible: insecure permission on a directory when using spacewalk inventory

[James Cammarata <jcammarata () ansible com>]

Hi Michael,

Thanks for finding this and fixing it, however we're not sure if this
requires a CVE? First of all, the impacted script is an optional inventory
script, which is not packaged with Ansible directly and must be downloaded
from the source repository. Second, the script (as you mentioned) creates
this directory typically in a relatively secure location, so the chances of
it being exposed are greatly lessened. Also, this is a relatively
under-utilized script, as not many people that we know of are getting host
information from Spacewalk using this script. Finally, the data contained
within that cache file is not very sensitive, and would typically only
contain the host IP information of systems from Spacewalk.

If a CVE is issued, we can mention it in the release, but we'd much rather
simply fix this ASAP and include it in the next major/minor release of
Ansible (2.0 and 1.9.2, respectively).

Thanks!


James Cammarata
Director, Ansible Core Engineering
github: jimi-c

On Fri, May 1, 2015 at 10:54 PM, Michael Scherer <misc () zarb org> wrote:

> Hi,
>
> Could a CVE be assigned for this problem :
>
> Ansible inventory script for spacewalk create a file in the current
> directory with incorrect permission due to a error in a chmod
> specification.
>
>
> https://github.com/ansible/ansible/blob/devel/plugins/inventory/spacewalk.py#L63
>
> In python, os.chmod need to be in octal, and 2755 is not octal.
> So in the end, we manage to have permission like this :
>
> d-ws-w-rwt.
>
> And o+rw and u+s kinda sound bad. The directory is created in $PWD if
> I read the code right, so that's likely the homedir of 1 admin.
> However, that's executed locally, or from a bastion, so there
> isn't much venue to attack ( even if shared shell server still exist
> nowadays ),
> and this requires to use spacewalk.
>
> I pushed a commit there :
>
> https://github.com/mscherer/ansible/commit/251197f11de7c7a3c5d81141970dd8f2ef16c0ee
>
> I will wait for a CVE to be assigned before fixing the commit message, and
> push a
> PR ( cause i am quite bothered when I cannot find the CVE in the commit
> message)
>
> --
> Michael Scherer