New release v2.7.14

changelogs/.changes.yaml

@@ -656,6 +656,16 @@ releases:
     - dont_template_passwords_from_prompt.yml
     - v2.7.13_summary.yaml
     release_date: '2019-08-15'
+  2.7.14:
+    codename: In the Light
+    fragments:
+    - aci-42-filter-whitespace.yaml
+    - ansible-test-redact.yml
+    - boto-logging-credentials.yml
+    - dont-template-cli-passwords.yml
+    - no-log-sub-options-invalid-parameter.yaml
+    - v2.7.14_summary.yaml
+    release_date: '2019-10-17'
   2.7.2:
     codename: In the Light
     fragments:

changelogs/CHANGELOG-v2.7.rst

@@ -5,6 +5,30 @@ Ansible 2.7 "In the Light" Release Notes
 .. contents:: Topics
 
 
+v2.7.14
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2019-10-17
+| `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`__
+
+
+Minor Changes
+-------------
+
+- ansible-test defaults to redacting sensitive values (disable with the ``--no-redact`` option)
+
+Bugfixes
+--------
+
+- **SECURITY** - CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files.  inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG.  If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG.  This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH.  This did not affect aws ansible modules as those are executed in a separate process.  This has been fixed by switching to log level INFO
+- **security issue** - Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856)
+
+- **security issue** - properly hide parameters marked with ``no_log`` in suboptions when invalid parameters are passed to the module (CVE-2019-14858)
+- ACI modules - Fix a whitespace issue in filters for ACI 4.2 strict validation
+
 v2.7.13
 =======
 

changelogs/fragments/v2.7.14_summary.yaml

@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2019-10-17
+   | `Porting Guide <https://docs.ansible.com/ansible/devel/porting_guides.html>`__

lib/ansible/release.py

@@ -19,6 +19,6 @@
 from __future__ import (absolute_import, division, print_function)
 __metaclass__ = type
 
-__version__ = '2.7.13.post0'
+__version__ = '2.7.14'
 __author__ = 'Ansible, Inc.'
 __codename__ = 'In the Light'