From 4685fe5faa2d674c7cae0137fb277d093812cda5 Mon Sep 17 00:00:00 2001 From: Rick Elrod Date: Tue, 1 Sep 2020 19:02:56 -0500 Subject: [PATCH] [docs] Fix up porting guides for CVE revert [2.9] (#71582) Change: - Fix up wording and do proper backports for porting guide entries. - Remove original, non-backported version Signed-off-by: Rick Elrod (cherry picked from commit ed48a2dd624cb7feb874fddcf49ef538857cd3e6) --- docs/docsite/rst/porting_guides/porting_guide_2.8.rst | 5 +++++ docs/docsite/rst/porting_guides/porting_guide_2.9.rst | 9 +++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/docs/docsite/rst/porting_guides/porting_guide_2.8.rst b/docs/docsite/rst/porting_guides/porting_guide_2.8.rst index d4879d353eb..4b695e63ebf 100644 --- a/docs/docsite/rst/porting_guides/porting_guide_2.8.rst +++ b/docs/docsite/rst/porting_guides/porting_guide_2.8.rst @@ -376,6 +376,11 @@ add ``$ErrorActionPreference = "Continue"`` to the top of the module. This chang of the EAP that was accidentally removed in a previous release and ensure that modules are more resilient to errors that may occur in execution. +* Version 2.8.14 of Ansible changed the default mode of file-based tasks to ``0o600 & ~umask`` when the user did not specify a ``mode`` parameter on file-based tasks. This was in response to a CVE report which we have reconsidered. As a result, the ``mode`` change has been reverted in 2.8.15, and ``mode`` will now default to ``0o666 & ~umask`` as in previous versions of Ansible. +* If you changed any tasks to specify less restrictive permissions while using 2.8.14, those changes will be unnecessary (but will do no harm) in 2.8.15. +* To avoid the issue raised in CVE-2020-1736, specify a ``mode`` parameter in all file-based tasks that accept it. + + Modules removed --------------- diff --git a/docs/docsite/rst/porting_guides/porting_guide_2.9.rst b/docs/docsite/rst/porting_guides/porting_guide_2.9.rst index 50bae9ecb4c..770c9f11c9d 100644 --- a/docs/docsite/rst/porting_guides/porting_guide_2.9.rst +++ b/docs/docsite/rst/porting_guides/porting_guide_2.9.rst @@ -77,6 +77,11 @@ Modules * The ``win_get_url`` and ``win_uri`` module now sends requests with a default ``User-Agent`` of ``ansible-httpget``. This can be changed by using the ``http_agent`` key. * The ``apt`` module now honors ``update_cache=false`` while installing its own dependency and skips the cache update. Explicitly setting ``update_cache=true`` or omitting the param ``update_cache`` will result in a cache update while installing its own dependency. +* Version 2.9.12 of Ansible changed the default mode of file-based tasks to ``0o600 & ~umask`` when the user did not specify a ``mode`` parameter on file-based tasks. This was in response to a CVE report which we have reconsidered. As a result, the mode change has been reverted in 2.9.13, and mode will now default to ``0o666 & ~umask`` as in previous versions of Ansible. +* If you changed any tasks to specify less restrictive permissions while using 2.9.12, those changes will be unnecessary (but will do no harm) in 2.9.13. +* To avoid the issue raised in CVE-2020-1736, specify a ``mode`` parameter in all file-based tasks that accept it. + + Renaming from ``_facts`` to ``_info`` -------------------------------------- @@ -113,10 +118,6 @@ Writing modules .. seealso:: `The Python Relative Import Docs `_ go into more detail of how to write relative imports. -* Version 2.9.12 of Ansible changed the default mode of file-based tasks to ``0o600`` when the user did not specify a ``mode`` parameter on file-based tasks. This was in response to a CVE report which we have reconsidered and no longer consider a flaw in Ansible. As a result, the ``mode`` change has been reverted in 2.9.13, and ``mode`` will now default to ``0o666`` as in previous versions of Ansible. -* If you changed any tasks to specify less restrictive permissions while using 2.9.12, those changes will be unnecessary (but will do no harm) in 2.9.13. -* To avoid the issue raised in CVE-2020-1736, specify a ``mode`` parameter in all file-based tasks that accept it. - Modules removed ---------------