# Ansible 1.5.1 released: security updates **URL:** \ **Category:** Ansible Project\ **Created:** [March 10, 2014, 11:23pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751 "2014-03-10T23:23:45Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 10, 2014, 11:23pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/1 "2014-03-10T23:23:45Z")
Ansible 1.5.1 Release Notes Today we’re releasing Ansible 1.5.1 which contains three security fixes/upgrades as well as a few assorted bugfixes that have been applied since the 1.5 release. An upgrade is suggested for all users using vault, interacting with web-properties over https://, or those users allowing outside untrusted input to be passed as variables to their ansible playbooks. The security improvements are as follows: Ansible Vault has been updated in terms of how the cipher logic has been implemented to make the content harder to brute force. Using the “edit” or “rekey” functions in vault will automatically upgrade an existing vault-encrypted file to the new format, and the new format is also the method used for any new files that vault creates. Users are encouraged to upgrade their content as follows, and should also consider changing any passwords or keys in vault-encrypted files to take advantage of security upgrades, as the previous versions would still exist in SCM history or may have been copied by another party. cd your\_playbook\_directory/ find . -type f | xargs grep -l ‘$ANSIBLE\_VAULT;1.0;AES’ | xargs ansible-vault rekey Note that the version of pycrypto Vault now needs is newer than what is carried in the base channel of Red Hat and CentOS, so if you are using this distribution you may benefit from: yum install python-devel rpm -e --nodeps python-crypto pip install pycrypto If you have a downlevel version the system will warn you about this. If you are using vault, you need not worry about this dependency. Core ansible modules (other than the shell module) have been upgraded to avoid running user input through the shell. Some ansible users have proxied ansible behind a wrapper script or web proxy (including Ansible Tower), that allows users who do not personally have access to machines to be able to supply variables as input into playbook executions. This includes doing things such as providing a value to “–extra-args” that might contain a semicolon, allowing them to run commands as a remote user. Removing the ability to use the shell in all of these modules prevents command injection in this case. The shell module by design executes commands through the shell, so if user supplied variables are being fed to things executed by the shell module, consider using the “command” module instead or whether users supplying input are trustworthy. User developed modules can take advantage of these upgrades by using the “run\_command” function in “module\_utils”, which will by default not allow any form of shell usage, which is now standard and required for all ansible modules in core. Regardless of this fix application, users of ansible should realize that any user that is allowed to write playbooks can control the systems upon which the playbooks are applied, which is intentional and by design. Finally, code that performs URL downloads of https:// URLs has been upgraded to validate the certificates where possible, unless a new parameter “validate\_certs=no” is passed to the module. This ensures that web servers that are interacted with are signed by a known certificate authority. It is very likely that this may require playbook alteration to add a “validate\_certs=no” to any modules like “get\_url” that interact with self-signed web services, such as continuous integration servers. In the event that this should occur, the playbook will report an appropriate error message and reference the ability to add “validate\_certs=no” to get around the error message. Ansible 1.5.1 is available now on [http://releases.ansible.com](http://releases.ansible.com) as well as the python package index, via “pip install ansible”. It is anticipated that distribution copies of the package, as well as other repositories, will pick this up soon. ---
**Author:** ![Walid](https://avatars.discourse-cdn.com/v4/letter/w/ea5d25/32.png) [@Walid](https://forum.ansible.com/u/Walid)\ **Post date:** [March 11, 2014, 7:55am UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/2 "2014-03-11T07:55:28Z")
I see 1.5.2 in github too ---
**Author:** ![Makimoto\_Marakatti](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@Makimoto\_Marakatti](https://forum.ansible.com/u/Makimoto_Marakatti)\ **Post date:** [March 11, 2014, 9:16am UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/3 "2014-03-11T09:16:23Z")
Hi On the release dir, the new file reads: ansible-1.6.tar.gz 10-Mar-2014 23:13 532K > > I’m guessing this is a typo?? ---
**Author:** ![Walid](https://avatars.discourse-cdn.com/v4/letter/w/ea5d25/32.png) [@Walid](https://forum.ansible.com/u/Walid)\ **Post date:** [March 11, 2014, 10:09am UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/4 "2014-03-11T10:09:01Z")
1.6 is the current development branch ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 11, 2014, 11:43am UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/5 "2014-03-11T11:43:19Z")
The 1.5.2 branch is for staging future dot releases, should we decide to produce a dot release. In particular we noted one problem with the airbrake module, so it lives there. It’s not actively released, nor tagged, at this point. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 11, 2014, 11:44am UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/6 "2014-03-11T11:44:18Z")
The 1.5.1 tarball is there as well. The 1.6 tarball there is not a release tarball, and is a build system artifact that is a result of our CI and probably a wrong button press. I’ll have someone delete that shortly. Download the 1.5.1 tarball. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 11, 2014, 1:00pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/7 "2014-03-11T13:00:47Z")
Hello everyone, we have updated 1.5.1 with a 1.5.2 to fix a bug in the apt module as a result of the above. Please apply 1.5.2 instead. It should be available now and if we need to update any other modules, we will do so quickly. Thanks to everyone who reported things! ---
**Author:** ![Makimoto\_Marakatti](https://avatars.discourse-cdn.com/v4/letter/m/e19adc/32.png) [@Makimoto\_Marakatti](https://forum.ansible.com/u/Makimoto_Marakatti)\ **Post date:** [March 11, 2014, 1:01pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/8 "2014-03-11T13:01:19Z")
completely missed that. thanks! ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 11, 2014, 3:05pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/9 "2014-03-11T15:05:15Z")
Missed a cherry-pick on 1.5.2 The 1.5.2 tarball has been updated and the tag has been moved. PyPi has been updated. ---
**Author:** ![jok](https://avatars.discourse-cdn.com/v4/letter/j/ba9def/32.png) [@jok](https://forum.ansible.com/u/jok)\ **Post date:** [March 11, 2014, 8:25pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/10 "2014-03-11T20:25:14Z")
Hello, Are there any plans to give users the option of re-enabling execution via shell (for the pipe lookup module in particular) or is it to be considered “officially wrong” from now on? We’re using something like: macro\_new\_pass32: “{{ lookup(‘pipe’,‘cat /dev/urandom | tr -dc A-Za-z0-9 | head -c32’) }}” to generate temporary throw away passwords without putting them into a file on the local machine (like the password lookup) which this change breaks. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [March 11, 2014, 9:33pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/11 "2014-03-11T21:33:02Z")
the lookup runs on the control machine, it is not passed to the target, only it’s result. ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [March 11, 2014, 9:36pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/12 "2014-03-11T21:36:02Z")
If the pipe filter is not working in a way that it previously worked, please file a bug and we will look into it. ---
**Author:** ![Prune](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@Prune](https://forum.ansible.com/u/Prune)\ **Post date:** [March 12, 2014, 4:19pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/13 "2014-03-12T16:19:47Z")
This code is also used in side modules, like the Flowdoc notification module where I get : msg: failed to validate the SSL certificate for [api.flowdock.com:443](http://api.flowdock.com:443). You can use validate\_certs=no, however this is unsafe and not recommended Adding the “validate\_certs=no” option to this module only return a : “msg: unsupported parameter for module: validate\_certs” ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 12, 2014, 4:21pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/14 "2014-03-12T16:21:32Z")
The validate\_certs thing is different from the shell stuff. We are currently working on some fixes for places that needed to have shell access (small number, but facts are included for non-Linux for example, and some git usage) and also are upgrading the cert detection. Should have a release soon-ish, so stay tuned. (The pipes stuff won’t need to request shell as it’s already executed with hit. if this is concerning, don’t include with\_pipe in the playbooks, etc) ---
**Author:** ![dlock](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@dlock](https://forum.ansible.com/u/dlock)\ **Post date:** [March 12, 2014, 10:02pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/15 "2014-03-12T22:02:25Z")
I’m doing this: > - name: Ensure Google Protocol Buffers source downloaded > get\_url: url=[https://protobuf.googlecode.com/files/protobuf-2.5.0.tar.bz2](https://protobuf.googlecode.com/files/protobuf-2.5.0.tar.bz2) dest={{ tmp }}/protobuf.tar.bz2 which worked fine with 1.5 - but with 1.5.2 from PyPi, I now get this: > failed: [default] =\> {“failed”: true, “item”: “”} > msg: failed to validate the SSL certificate for [protobuf.googlecode.com:443](http://protobuf.googlecode.com:443). You can use validate\_certs=no, however this is unsafe and not recommended > > FATAL: all hosts have already failed – aborting Adding validate\_certs=no to the get\_url fixes this, but it’s Google Code and seems to have a valid cert - according to my browsers - any idea why ansible doesn’t like it? I’m also getting this with bitbucket. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 14, 2014, 2:37pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/16 "2014-03-14T14:37:32Z")
1.5.3 is in PyPi now and this contains some improvements to check additional files and locations, let us know if you are still seeing any problems. (Ubuntu users may also wish to run update-ca-certs to get the latest files) –Michael ---
**Author:** ![dlock](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@dlock](https://forum.ansible.com/u/dlock)\ **Post date:** [March 14, 2014, 6:03pm UTC](https://forum.ansible.com/t/ansible-1-5-1-released-security-updates/14751/17 "2014-03-14T18:03:01Z")
Ansible 1.5.3 fixes this, thanks!