Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add pyup safety check json file as source for security warnings #450

Closed
fniessink opened this issue Jul 9, 2019 · 0 comments · Fixed by #453
Closed

Add pyup safety check json file as source for security warnings #450

fniessink opened this issue Jul 9, 2019 · 0 comments · Fixed by #453
Assignees
Labels
Source(s) New, enhanced, or removed metric source

Comments

@fniessink
Copy link
Member

Example json file:

[
    [
        "ansible",
        "<1.9.2",
        "1.8.5",
        "Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
        "25625"
    ],
    [
        "ansible",
        "<1.9.6",
        "1.8.5",
        "The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.",
        "25626"
    ],
    [
        "ansible",
        "<2.0.2",
        "1.8.5",
        "The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.",
        "25627"
    ],
    [
        "ansible",
        "<2.2.1",
        "1.8.5",
        "ansible before 2.2.1 is vulnerable to arbitrary code execution. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server as the user and group Ansible is running as.",
        "33286"
    ],
    [
        "ansible",
        "<2.3.1",
        "1.8.5",
        "ansible before 2.3.1 is vulnerable to CVE-2017-7481 - data for lookup plugins used as variables was not being correctly marked as \"unsafe\".",
        "34941"
    ]
]
@fniessink fniessink added the Source(s) New, enhanced, or removed metric source label Jul 9, 2019
@fniessink fniessink self-assigned this Jul 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Source(s) New, enhanced, or removed metric source
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant