# IMPORTANT - New RCs for Security Bug CVE-2016-9587 **URL:** \ **Category:** Ansible Project\ **Created:** [January 9, 2017, 4:57pm UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410 "2017-01-09T16:57:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [January 9, 2017, 4:57pm UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/1 "2017-01-09T16:57:06Z")
Hi all, Today we are releasing two new release candidates to address CVE-2016-9587, which we are removing from embargo today: 2.1.4 RC1 2.2.1 RC3 CVE-2016-9587 is rated as HIGH in risk, as a compromised remote system being managed via Ansible can lead to commands being run on the Ansible controller (as the user running the ansible or ansible-playbook command). If you have the ability, please test the above release candidates so that we can get the final releases out as quickly as possible. Finally, thanks to the security team at Computest, who did an amazing job of finding the flaws and creating an excellent set of tests to reproduce them for us. Thanks, and let us know if you run into any problems with the above release candidates! ---
**Author:** ![Bernhard\_L](https://avatars.discourse-cdn.com/v4/letter/b/7ba0ec/32.png) [@Bernhard\_L](https://forum.ansible.com/u/Bernhard_L)\ **Post date:** [January 10, 2017, 11:52am UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/2 "2017-01-10T11:52:58Z")
Hi, there is a new bug with service restart and refresh on Solaris 10. I added a comment in [https://github.com/ansible/ansible-modules-core/issues/5296](https://github.com/ansible/ansible-modules-core/issues/5296) where the bug was introduced (with a fix for Solaris 11). Regards, Bernhard ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [January 10, 2017, 5:34pm UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/3 "2017-01-10T17:34:24Z")
Please don’t comment on closed issues as we don’t see those normally. ---
**Author:** ![Bernhard\_L](https://avatars.discourse-cdn.com/v4/letter/b/7ba0ec/32.png) [@Bernhard\_L](https://forum.ansible.com/u/Bernhard_L)\ **Post date:** [January 10, 2017, 6:41pm UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/4 "2017-01-10T18:41:51Z")
I’m sorry. Opened a new issue: [https://github.com/ansible/ansible/issues/20102](https://github.com/ansible/ansible/issues/20102) ---
**Author:** ![iseba](https://avatars.discourse-cdn.com/v4/letter/i/a587f6/32.png) [@iseba](https://forum.ansible.com/u/iseba)\ **Post date:** [January 11, 2017, 10:12am UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/5 "2017-01-11T10:12:36Z")
Are you will add in debian repository the fixes ? Thank for your support ---
**Author:** ![Bryan\_Pfremmer](https://avatars.discourse-cdn.com/v4/letter/b/ee59a6/32.png) [@Bryan\_Pfremmer](https://forum.ansible.com/u/Bryan_Pfremmer)\ **Post date:** [January 11, 2017, 8:38pm UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/6 "2017-01-11T20:38:05Z")
Does this apply to ansible 1.9? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [January 12, 2017, 5:18am UTC](https://forum.ansible.com/t/important-new-rcs-for-security-bug-cve-2016-9587/23410/7 "2017-01-12T05:18:21Z")
Most older versions should be vulnerable, we recommend upgrading to 2.1 or 2.2 once we release the fix.