ansible/changelogs/fragments/cve-2024-8775.yml at v2.19.2 - ansible - Gitea - Nicolas Simond

starred/ansible

mirror of https://github.com/ansible/ansible.git synced 2026-08-03 08:03:05 +02:00

Files

T

Matt DavisandGitHub c9ac477e53 Preserve _ansible_no_log from action result; fix include_vars to set properly (#84143 )

* fixes for CVE-2024-8775

* propagate truthy `_ansible_no_log` in action result (previously superseded by task-calculated value)
* always mask entire `include_vars` action result if any file loaded had a false `show_content` flag (previously used only the flag value from the last file loaded)

* update no_log tests for CVE-2024-8775
* include validation of _ansible_no_log preservation when set by actions
* replace static values with dynamic for increased robustness to logging/display/callback changes (but still using grep counts :( )

* changelog

* use ternary, coerce to bool explicitly

2024-10-24 22:56:54 +00:00

6 lines

281 B

YAML

Raw Permalink Blame History

 security_fixes:
   - task result processing - Ensure that action-sourced result masking (``_ansible_no_log=True``)
     is preserved. (CVE-2024-8775)
   - include_vars action - Ensure that result masking is correctly requested when vault-encrypted
     files are read. (CVE-2024-8775)