ansible - Debian Package Tracker

general

source: ansible (main)
version: 14.0.0~a4+dfsg-1
maintainer: Debian Python Team (DMD)
uploaders: Lee Garrett [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
o-o-sec: 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4
o-o-p-u: 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
oldstable: 7.7.0+dfsg-3+deb12u1
stable: 12.0.0+dfsg-0+deb13u1
testing: 14.0.0~a4+dfsg-1
unstable: 14.0.0~a4+dfsg-1

versioned links

2.10.7+merged+base+2.10.17+dfsg-0+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.10.7+merged+base+2.10.17+dfsg-0+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.7.0+dfsg-3+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.0.0+dfsg-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
14.0.0~a4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ansible (6 bugs: 0, 6, 0, 0)

action needed

A new upstream version is available: 14.0.0 high

A new upstream version 14.0.0 is available, you should consider packaging it.

Created: 2026-03-26 Last update: 2026-06-12 13:01

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-11332: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Created: 2026-06-06 Last update: 2026-06-11 08:30

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Created: 2026-06-11 Last update: 2026-06-11 08:30

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Created: 2026-06-11 Last update: 2026-06-11 08:30

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Created: 2026-06-11 Last update: 2026-06-11 08:30

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-11837: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Created: 2026-06-11 Last update: 2026-06-11 08:30

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2023-5764: A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
CVE-2024-0690: An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

3 issues postponed or untriaged:

CVE-2023-4237: (needs triaging) A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
CVE-2019-14858: (needs triaging) A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.
CVE-2019-14905: (needs triaging) A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Created: 2023-09-27 Last update: 2024-06-25 20:04

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-06-12 15:47

lintian reports 127 warnings normal

Lintian reports 127 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-05-23 Last update: 2026-05-23 05:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-05-22 22:30

news

[rss feed]

[2026-05-26] ansible 14.0.0~a4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-22] Accepted ansible 14.0.0~a4+dfsg-1 (source) into unstable (Lee Garrett)
[2026-03-17] Accepted ansible 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4 (source) into oldoldstable-security (Lee Garrett)
[2026-03-17] ansible 13.4.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-03-14] Accepted ansible 13.4.0+dfsg-1 (source) into unstable (Lee Garrett)
[2025-12-22] Accepted ansible 12.0.0+dfsg-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Lee Garrett)
[2025-12-22] ansible 13.1.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-12-22] ansible 13.1.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-12-18] Accepted ansible 13.1.0+dfsg-1 (source) into unstable (Lee Garrett)
[2025-12-07] ansible 12.2.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-12-05] Accepted ansible 12.2.0+dfsg-1 (source) into unstable (Lee Garrett)
[2025-10-19] Accepted ansible 12.0.0~b5+dfsg-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Lee Garrett)
[2025-09-14] ansible 12.0.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-09-10] Accepted ansible 12.0.0+dfsg-1 (source) into unstable (Lee Garrett)
[2025-08-29] ansible 12.0.0~b5+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-26] Accepted ansible 12.0.0~b5+dfsg-1 (source) into unstable (Lee Garrett)
[2025-08-18] ansible 12.0.0~b3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-14] Accepted ansible 12.0.0~b3+dfsg-1 (source) into unstable (Lee Garrett)
[2025-08-13] ansible 12.0.0~b2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-05] Accepted ansible 12.0.0~b2+dfsg-1 (source) into unstable (Lee Garrett)
[2025-07-23] Accepted ansible 12.0.0~b1+dfsg-1 (source) into unstable (Lee Garrett)
[2025-07-04] ansible 12.0.0~a6+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-06-13] Accepted ansible 12.0.0~a6+dfsg-1 (source) into unstable (Lee Garrett)
[2025-06-03] ansible 12.0.0~a4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-05-13] Accepted ansible 12.0.0~a4+dfsg-1 (source) into unstable (Lee Garrett)
[2025-05-12] ansible 12.0.0~a2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-05-03] Accepted ansible 2.10.7+merged+base+2.10.17+dfsg-0+deb11u3 (source) into oldstable-security (Lee Garrett)
[2025-05-01] Accepted ansible 12.0.0~a2+dfsg-1 (source) into unstable (Lee Garrett)
[2025-04-29] ansible 12.0.0~a1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-04-17] Accepted ansible 12.0.0~a1+dfsg-1 (source) into unstable (Lee Garrett)

bugs [bug history graph]

all: 7
RC: 0
I&N: 7
M&W: 0
F&P: 0
patch: 1

links

homepage
lintian (0, 127)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 13.1.0+dfsg-1ubuntu1