1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-25 03:17:13 +00:00
nixpkgs/pkgs/tools/admin/ansible/default.nix

38 lines
1.1 KiB
Nix
Raw Normal View History

{ python3Packages, fetchurl }:
2019-11-06 15:42:55 +00:00
rec {
ansible = ansible_2_8;
2019-11-06 15:42:55 +00:00
ansible_2_9 = python3Packages.toPythonApplication python3Packages.ansible;
ansible_2_8 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
2019-11-06 15:42:55 +00:00
pname = "ansible";
version = "2.8.11";
2019-11-06 15:42:55 +00:00
src = fetchurl {
url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz";
sha256 = "14f1m4jjkicadaz4d1dm8xhj53kdwksf0znmqzaz1fb0dj5slv0m";
2019-11-06 15:42:55 +00:00
};
}));
2019-05-18 09:59:35 +01:00
ansible_2_7 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
2019-05-18 09:59:35 +01:00
pname = "ansible";
version = "2.7.17";
2019-05-18 09:59:35 +01:00
src = fetchurl {
url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz";
sha256 = "1k2cz4w3r3an37305f40vi93wqixapls9y6ggkf75nbs7z27knwz";
2019-05-18 09:59:35 +01:00
};
}));
ansible_2_6 = python3Packages.toPythonApplication (python3Packages.ansible.overridePythonAttrs (old: rec {
pname = "ansible";
ansible_2_6: 2.6.17 -> 2.6.20 This addresses the following security issues: * CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG. If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG. This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH. This did not affect aws ansible modules as those are executed in a separate process. This has been fixed by switching to log level INFO * Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856) * properly hide parameters marked with no_log in suboptions when invalid parameters are passed to the module (CVE-2019-14858) * resolves CVE-2019-10206, by avoiding templating passwords from prompt as it is probable they have special characters. * Handle improper variable substitution that was happening in safe_eval, it was always meant to just do 'type enforcement' and have Jinja2 deal with all variable interpolation. Also see CVE-2019-10156 Changelog: https://github.com/ansible/ansible/blob/9bdb89f740a87bcf760424577ce18a8f68d7a741/changelogs/CHANGELOG-v2.6.rst
2019-12-15 20:22:30 +00:00
version = "2.6.20";
2018-08-13 14:30:41 +01:00
src = fetchurl {
url = "https://releases.ansible.com/ansible/${pname}-${version}.tar.gz";
ansible_2_6: 2.6.17 -> 2.6.20 This addresses the following security issues: * CVE-2019-14846 - Several Ansible plugins could disclose aws credentials in log files. inventory/aws_ec2.py, inventory/aws_rds.py, lookup/aws_account_attribute.py, and lookup/aws_secret.py, lookup/aws_ssm.py use the boto3 library from the Ansible process. The boto3 library logs credentials at log level DEBUG. If Ansible's logging was enabled (by setting LOG_PATH to a value) Ansible would set the global log level to DEBUG. This was inherited by boto and would then log boto credentials to the file specified by LOG_PATH. This did not affect aws ansible modules as those are executed in a separate process. This has been fixed by switching to log level INFO * Convert CLI provided passwords to text initially, to prevent unsafe context being lost when converting from bytes->text during post processing of PlayContext. This prevents CLI provided passwords from being incorrectly templated (CVE-2019-14856) * properly hide parameters marked with no_log in suboptions when invalid parameters are passed to the module (CVE-2019-14858) * resolves CVE-2019-10206, by avoiding templating passwords from prompt as it is probable they have special characters. * Handle improper variable substitution that was happening in safe_eval, it was always meant to just do 'type enforcement' and have Jinja2 deal with all variable interpolation. Also see CVE-2019-10156 Changelog: https://github.com/ansible/ansible/blob/9bdb89f740a87bcf760424577ce18a8f68d7a741/changelogs/CHANGELOG-v2.6.rst
2019-12-15 20:22:30 +00:00
sha256 = "02ra9q2mifyawn0719y78wrbqzik73aymlzwi90fq71jgyfvkkqn";
};
}));
}