# Ansible 2.1.3 FINAL has been released! **URL:** \ **Category:** Ansible Project\ **Tags:** azure, ubuntu\ **Created:** [November 4, 2016, 5:28pm UTC](https://forum.ansible.com/t/ansible-2-1-3-final-has-been-released/22964 "2016-11-04T17:28:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [November 4, 2016, 5:28pm UTC](https://forum.ansible.com/t/ansible-2-1-3-final-has-been-released/22964/1 "2016-11-04T17:28:38Z")
Hi all, we’re very happy to announce that Ansible 2.1.3 has been released! This release fixes many bugs, including the two CVE-related bugs also fixed in the 2.2.0 release: - Security fix for CVE-2016-8628 - Command injection by compromised server via fact variables. In some situations, facts returned by modules could overwrite connection-based facts or some other special variables, leading to injected commands running on the Ansible controller as the user running Ansible (or via escalated permissions). - Security fix for CVE-2016-8614 - apt\_key module not properly validating keys in some situations. - Fixed several bugs related to locating files relative to role/playbook directories. - Fixed a bug in the way hosts were tested for failed states, resulting in incorrectly skipped block sessions. - Fixed a bug in the way our custom JSON encoder is used for the to\_json\* filters. - Fixed some bugs related to the use of non-ascii characters in become passwords. - Fixed postgres\* and subversion modules to ensure password fields were not displayed when no\_log=True is used. - Fixed a bug with Azure modules which may be using the latest rc6 library. - Backported some docker\_common fixes. As always, this update is available via PyPi and [releases.ansible.com](http://releases.ansible.com) now, and packages for distros will be available as soon as possible. We have also created the following PPA for 2.1.x versions: [https://launchpad.net/~ansible/+archive/ubuntu/ansible-2.1](https://launchpad.net/~ansible/+archive/ubuntu/ansible-2.1) If you discover any errors, or if you see any regressions from playbooks which work on 1.9.x and prior, please open a Github issue and be sure to mention the version of Ansible you’re running. Thanks, and enjoy! ---
**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\ **Post date:** [November 5, 2016, 1:31am UTC](https://forum.ansible.com/t/ansible-2-1-3-final-has-been-released/22964/2 "2016-11-05T01:31:00Z")
James Cammarata: > Hi all, we're very happy to announce that Ansible 2.1.3 has been released! > > This release fixes many bugs, including the two CVE-related bugs also fixed > in the 2.2.0 release: > > \* Security fix for CVE-2016-8628 - Command injection by compromised server > via fact variables. In some situations, facts returned by modules could > overwrite connection-based facts or some other special variables, leading > to injected commands running on the Ansible controller as the user running > Ansible (or via escalated permissions). > \* Security fix for CVE-2016-8614 - apt\_key module not properly validating > keys in some situations. If ansible v2.2.0 fixed two vulnerabilities (CVE-2016-8628, CVE-2016-8614) why was there no mention about that in the release announcement? Is there a mailing list one can sign up to, to just get release announcements? thanks, nusenu ---
**Author:** ![Nusenu1](https://avatars.discourse-cdn.com/v4/letter/n/db5fbb/32.png) [@Nusenu1](https://forum.ansible.com/u/Nusenu1)\ **Post date:** [November 5, 2016, 2:13am UTC](https://forum.ansible.com/t/ansible-2-1-3-final-has-been-released/22964/3 "2016-11-05T02:13:00Z")
nusenu: > Is there a mailing list one can sign up to, to just get release > announcements? [https://groups.google.com/forum/#!forum/ansible-announce](https://groups.google.com/forum/#!forum/ansible-announce)