# IMPORTANT - Updated RCs for Security Bug CVE-2016-9587 **URL:** \ **Category:** Ansible Project\ **Created:** [January 11, 2017, 10:36pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439 "2017-01-11T22:36:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [January 11, 2017, 10:36pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/1 "2017-01-11T22:36:12Z")
Hi all, We’ve just released the following release candidates to address a few more corner cases found after the release of the previous RCs for CVE-2016-9587: 2.1.4 RC2 2.2.1 RC4 Thanks again to Computest for double-checking our fixes and pointing out a couple of places we had missed. We are still looking to get the final releases out by the end of the week, so please be sure to test these RC’s for any breaks in your playbooks. Thanks! ---
**Author:** ![robb](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@robb](https://forum.ansible.com/u/robb)\ **Post date:** [January 12, 2017, 8:38pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/2 "2017-01-12T20:38:34Z")
Thanks James and Ansible team. I presume that this affects Ansible 2.0 and 1.9, but the CVE text is a little ambiguous: (Affected versions: \< 2.1.4, \< 2.2.1). Can you or someone from Ansible confirm? If 1.9 is affected, will the fix will be back-ported? Thank you, Robb ---
**Author:** ![robb](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@robb](https://forum.ansible.com/u/robb)\ **Post date:** [January 12, 2017, 8:43pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/3 "2017-01-12T20:43:48Z")
According to the Gentoo bug ([https://bugs.gentoo.org/show\_bug.cgi?id=605342#c4](https://bugs.gentoo.org/show_bug.cgi?id=605342#c4)) 1.9.4 is affected. ---
**Author:** ![Jason\_McKerr1](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@Jason\_McKerr1](https://forum.ansible.com/u/Jason_McKerr1)\ **Post date:** [January 12, 2017, 9:10pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/4 "2017-01-12T21:10:52Z")
Hi Robb, These issues DO affect 2.0 and 1.9. Unfortunately we won’t be backporting fixes to those versions. Users will have to upgrade to one of the newer versions (2.1.x or 2.2.x). I apologize for this. 1.9.x in particular would have meant changing huge amounts of code to the point of really re-writing important parts of Ansible Core. Jason McKerr Director, Ansible Core Engineering Ansible by Red Hat. ---
**Author:** ![james4](https://avatars.discourse-cdn.com/v4/letter/j/9f8e36/32.png) [@james4](https://forum.ansible.com/u/james4)\ **Post date:** [January 12, 2017, 9:30pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/5 "2017-01-12T21:30:52Z")
Just to be clear this affects both ansible-pull and ansible-push right? When the RC’s are ready will it be posted in Announcements and be available via pypi? ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [January 12, 2017, 9:38pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/6 "2017-01-12T21:38:55Z")
once ready we will push to all the normal channels we control (including pypi), until then you can try out the RC at [http://releases.ansible.com/ansible/ansible-2.2.1.0-0.4.rc4.tar.gz](http://releases.ansible.com/ansible/ansible-2.2.1.0-0.4.rc4.tar.gz) ---
**Author:** ![Michael\_Scherer](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@Michael\_Scherer](https://forum.ansible.com/u/Michael_Scherer)\ **Post date:** [January 12, 2017, 11:49pm UTC](https://forum.ansible.com/t/important-updated-rcs-for-security-bug-cve-2016-9587/23439/7 "2017-01-12T23:49:17Z")
Ansible-pull would be affected, but since this requires the remote system to be compromised first, exploiting ansible-pull would change anything since it is running on the same system.