Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ansible-core-2.20 for openSUSE:Factory checked in at 2026-10-05 13:05:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ansible-core-2.20 (Old) and /work/SRC/openSUSE:Factory/.ansible-core-2.20.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ansible-core-2.20" Mon Oct 5 13:05:05 2026 rev:5 rq:1382364 version:2.20.9 Changes: -------- --- /work/SRC/openSUSE:Factory/ansible-core-2.20/ansible-core-2.20.changes 2026-09-18 22:04:32.057553579 +0200 +++ /work/SRC/openSUSE:Factory/.ansible-core-2.20.new.3698736/ansible-core-2.20.changes 2026-10-05 13:05:08.572668761 +0200 @@ -1,0 +2,11 @@ +Sun Sep 27 15:53:14 UTC 2026 - Harshvardhan Sharma <[email protected]> + +- Security fix for CVE-2026-16493 (bsc#1272369): argument injection in + ansible-galaxy collection install; build the git clone options first and + pass the collection URL positionally after a "--" separator, so a git+ URL + beginning with "-" cannot be parsed by git as an option. Twin of + CVE-2026-11332 (role path). SUSE candidate patch; upstream hardening + tracked in gh#ansible/ansible#87177 (open, unmerged). + * add ansible-core-CVE-2026-16493.patch + +------------------------------------------------------------------- New: ---- ansible-core-CVE-2026-16493.patch ----------(New B)---------- New: tracked in gh#ansible/ansible#87177 (open, unmerged). * add ansible-core-CVE-2026-16493.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ansible-core-2.20.spec ++++++ --- /var/tmp/diff_new_pack.KjeN6i/_old 2026-10-05 13:05:10.237738542 +0200 +++ /var/tmp/diff_new_pack.KjeN6i/_new 2026-10-05 13:05:10.238738584 +0200 @@ -50,6 +50,8 @@ URL: https://ansible.com/ Source0: https://files.pythonhosted.org/packages/source/a/ansible-core/ansible_core-%{version}.tar.gz#/ansible_core-%{version}.tar.gz Source1: ansible_core-%{version}.tar.gz.sha256 +# CVE-2026-16493 (bsc#1272369) +Patch0: ansible-core-CVE-2026-16493.patch BuildArch: noarch Provides: ansible-core = %{version} ++++++ ansible-core-CVE-2026-16493.patch ++++++ >From d76e1a46ab62f79c32d73bf0c74e9cb8fd9a83ac Mon Sep 17 00:00:00 2001 From: Harshvardhan Sharma <[email protected]> Date: Tue, 18 Aug 2026 12:00:00 +0000 Subject: [PATCH] Fix CVE-2026-16493 - prevent collection git source from injecting git options SUSE candidate fix (no upstream commit exists as of 2026-08-18; regenerate from the upstream commit once it lands and swap this patch). _extract_collection_from_git() in lib/ansible/galaxy/collection/concrete_artifact_manager.py built the 'git clone' command with the user-supplied collection URL as a bare positional. A 'git+'-prefixed source whose URL begins with '-' (e.g. 'git+--upload-pack=...') was parsed by git as an option instead of a repository, allowing argument injection (CWE-88) when running 'ansible-galaxy collection install'. This is the collection-install twin of CVE-2026-11332, which hardened only the role-install path (lib/ansible/utils/galaxy.py). Build the git options first, then append the URL and destination after a '--' end-of-options separator so a leading-dash URL can never be treated as an option. Update the collection scm unit tests to expect the '--'. --- .../galaxy/collection/concrete_artifact_manager.py | 9 +++++++-- test/units/galaxy/test_collection_install.py | 7 ++++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/lib/ansible/galaxy/collection/concrete_artifact_manager.py b/lib/ansible/galaxy/collection/concrete_artifact_manager.py index 9a5775e..6d03822 100644 --- a/lib/ansible/galaxy/collection/concrete_artifact_manager.py +++ b/lib/ansible/galaxy/collection/concrete_artifact_manager.py @@ -407,14 +407,19 @@ def _extract_collection_from_git(repo_url, coll_ver, b_path): # Perform a shallow clone if simply cloning HEAD if version == 'HEAD': - git_clone_cmd = [git_executable, 'clone', '--depth=1', git_url, to_text(b_checkout_path)] + git_clone_cmd = [git_executable, 'clone', '--depth=1'] else: - git_clone_cmd = [git_executable, 'clone', git_url, to_text(b_checkout_path)] + git_clone_cmd = [git_executable, 'clone'] # FIXME: '--branch', version if context.CLIARGS['ignore_certs'] or C.GALAXY_IGNORE_CERTS: git_clone_cmd.extend(['-c', 'http.sslVerify=false']) + # CVE-2026-16493: pass the user-supplied URL positionally after '--' so a + # URL beginning with '-' cannot be parsed by git as an option (argument + # injection). Any git options must precede this '--' separator. + git_clone_cmd.extend(['--', git_url, to_text(b_checkout_path)]) + try: subprocess.check_call(git_clone_cmd) except subprocess.CalledProcessError as proc_err: diff --git a/test/units/galaxy/test_collection_install.py b/test/units/galaxy/test_collection_install.py index dc6dbe5..8c5504b 100644 --- a/test/units/galaxy/test_collection_install.py +++ b/test/units/galaxy/test_collection_install.py @@ -144,7 +144,7 @@ def test_concrete_artifact_manager_scm_cmd(url, version, trailing_slash, monkeyp repo += '/' git_executable = get_bin_path('git') - clone_cmd = [git_executable, 'clone', repo, ''] + clone_cmd = [git_executable, 'clone', '--', repo, ''] assert mock_subprocess_check_call.call_args_list[0].args[0] == clone_cmd assert mock_subprocess_check_call.call_args_list[1].args[0] == (git_executable, 'checkout', 'commitish') @@ -175,7 +175,7 @@ def test_concrete_artifact_manager_scm_cmd_shallow(url, version, trailing_slash, if trailing_slash: repo += '/' git_executable = get_bin_path('git') - shallow_clone_cmd = [git_executable, 'clone', '--depth=1', repo, ''] + shallow_clone_cmd = [git_executable, 'clone', '--depth=1', '--', repo, ''] assert mock_subprocess_check_call.call_args_list[0].args[0] == shallow_clone_cmd assert mock_subprocess_check_call.call_args_list[1].args[0] == (git_executable, 'checkout', 'HEAD') @@ -205,9 +205,10 @@ def test_concrete_artifact_manager_scm_cmd_validate_certs(ignore_certs_cli, igno assert mock_subprocess_check_call.call_count == 2 git_executable = get_bin_path('git') - clone_cmd = [git_executable, 'clone', '--depth=1', url, ''] + clone_cmd = [git_executable, 'clone', '--depth=1'] if expected_ignore_certs: clone_cmd.extend(['-c', 'http.sslVerify=false']) + clone_cmd.extend(['--', url, '']) assert mock_subprocess_check_call.call_args_list[0].args[0] == clone_cmd assert mock_subprocess_check_call.call_args_list[1].args[0] == (git_executable, 'checkout', 'HEAD') -- 2.55.0
