From 6935c8e303440addd3871ecf8e04bde61080b032 Mon Sep 17 00:00:00 2001 From: Matt Martz Date: Thu, 18 Jan 2024 15:37:39 -0600 Subject: [PATCH] Ensure ANSIBLE_NO_LOG is respected (CVE-2024-0690) (#82565) --- changelogs/fragments/cve-2024-0690.yml | 2 ++ lib/ansible/playbook/base.py | 2 +- lib/ansible/playbook/play_context.py | 4 ---- test/integration/targets/no_log/no_log_config.yml | 13 +++++++++++++ test/integration/targets/no_log/runme.sh | 5 +++++ 5 files changed, 21 insertions(+), 5 deletions(-) create mode 100644 changelogs/fragments/cve-2024-0690.yml create mode 100644 test/integration/targets/no_log/no_log_config.yml diff --git a/changelogs/fragments/cve-2024-0690.yml b/changelogs/fragments/cve-2024-0690.yml new file mode 100644 index 00000000000..0e030d88864 --- /dev/null +++ b/changelogs/fragments/cve-2024-0690.yml @@ -0,0 +1,2 @@ +security_fixes: +- ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was ignored (CVE-2024-0690) diff --git a/lib/ansible/playbook/base.py b/lib/ansible/playbook/base.py index b6b3f10d341..49784901796 100644 --- a/lib/ansible/playbook/base.py +++ b/lib/ansible/playbook/base.py @@ -730,7 +730,7 @@ class Base(FieldAttributeBase): # flags and misc. settings environment = FieldAttribute(isa='list', extend=True, prepend=True) - no_log = FieldAttribute(isa='bool') + no_log = FieldAttribute(isa='bool', default=C.DEFAULT_NO_LOG) run_once = FieldAttribute(isa='bool') ignore_errors = FieldAttribute(isa='bool') ignore_unreachable = FieldAttribute(isa='bool') diff --git a/lib/ansible/playbook/play_context.py b/lib/ansible/playbook/play_context.py index e5aa976f413..0ee11094480 100644 --- a/lib/ansible/playbook/play_context.py +++ b/lib/ansible/playbook/play_context.py @@ -316,10 +316,6 @@ class PlayContext(Base): display.warning('The "%s" connection plugin has an improperly configured remote target value, ' 'forcing "inventory_hostname" templated value instead of the string' % new_info.connection) - # set no_log to default if it was not previously set - if new_info.no_log is None: - new_info.no_log = C.DEFAULT_NO_LOG - if task.check_mode is not None: new_info.check_mode = task.check_mode diff --git a/test/integration/targets/no_log/no_log_config.yml b/test/integration/targets/no_log/no_log_config.yml new file mode 100644 index 00000000000..8a5088059db --- /dev/null +++ b/test/integration/targets/no_log/no_log_config.yml @@ -0,0 +1,13 @@ +- hosts: testhost + gather_facts: false + tasks: + - debug: + no_log: true + + - debug: + no_log: false + + - debug: + + - debug: + loop: '{{ range(3) }}' diff --git a/test/integration/targets/no_log/runme.sh b/test/integration/targets/no_log/runme.sh index 795730bddd7..bf764bf9abc 100755 --- a/test/integration/targets/no_log/runme.sh +++ b/test/integration/targets/no_log/runme.sh @@ -19,3 +19,8 @@ set -eux # test invalid data passed to a suboption [ "$(ansible-playbook no_log_suboptions_invalid.yml -i ../../inventory -vvvvv "$@" | grep -Ec '(SUPREME|IDIOM|MOCKUP|EDUCATED|FOOTREST|CRAFTY|FELINE|CRYSTAL|EXPECTANT|AGROUND|GOLIATH|FREEFALL)')" = "0" ] + +# test variations on ANSIBLE_NO_LOG +[ "$(ansible-playbook no_log_config.yml -i ../../inventory -vvvvv "$@" | grep -Ec 'the output has been hidden')" = "1" ] +[ "$(ANSIBLE_NO_LOG=0 ansible-playbook no_log_config.yml -i ../../inventory -vvvvv "$@" | grep -Ec 'the output has been hidden')" = "1" ] +[ "$(ANSIBLE_NO_LOG=1 ansible-playbook no_log_config.yml -i ../../inventory -vvvvv "$@" | grep -Ec 'the output has been hidden')" = "6" ]