mirror of
https://github.com/ansible-collections/community.general.git
synced 2025-07-23 13:20:23 -07:00
inventory plugins: make data obtained from remote unsafe (#8098)
Make data obtained from remote unsafe.
This commit is contained in:
parent
b389f8637f
commit
d62fe154d2
14 changed files with 88 additions and 51 deletions
6
changelogs/fragments/inventory-rce.yml
Normal file
6
changelogs/fragments/inventory-rce.yml
Normal file
|
@ -0,0 +1,6 @@
|
|||
security_fixes:
|
||||
- "cobbler, gitlab_runners, icinga2, linode, lxd, nmap, online, opennebula, proxmox, scaleway, stackpath_compute, virtualbox,
|
||||
and xen_orchestra inventory plugin - make sure all data received from the remote servers is marked as unsafe, so remote
|
||||
code execution by obtaining texts that can be evaluated as templates is not possible
|
||||
(https://www.die-welt.net/2024/03/remote-code-execution-in-ansible-dynamic-inventory-plugins/,
|
||||
https://github.com/ansible-collections/community.general/pull/8098)."
|
Loading…
Add table
Add a link
Reference in a new issue