Skip to content

Instantly share code, notes, and snippets.

@gg7
Last active August 5, 2016 02:15
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save gg7/b5051936508cbfd18175 to your computer and use it in GitHub Desktop.
Save gg7/b5051936508cbfd18175 to your computer and use it in GitHub Desktop.
CVE-2015-7547 Ansible playbook
- hosts: all
remote_user: root
tasks:
- name: Apt-get update
apt: update_cache=yes cache_valid_time=3600
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
- name: Check if libc6 is installed (apt)
command: dpkg-query -W libc6
register: libc6
failed_when: libc6.rc > 1
changed_when: False
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
- name: Check if libc6-bin is installed (apt)
command: dpkg-query -W libc6-bin
register: libc6_bin
failed_when: libc6_bin.rc > 1
changed_when: False
when: ansible_distribution == 'Debian' or ansible_distribution == 'Ubuntu'
- name: Update libc6 if installed (apt)
apt: pkg=libc6 state=latest
when: (ansible_distribution =='Debian' or ansible_distribution == 'Ubuntu') and libc6.rc == 0
- name: Update libc6-bin if installed (apt)
apt: pkg=libc6-bin state=latest
when: (ansible_distribution =='Debian' or ansible_distribution == 'Ubuntu') and libc6_bin.rc == 0
- name: Check if glibc is installed (yum)
command: yum -q list installed glibc
register: glibc
failed_when: glibc.rc > 1
changed_when: False
when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
- name: Check if glibc-common is installed (yum)
command: yum -q list installed glibc-common
register: glibc_common
failed_when: glibc_common.rc > 1
changed_when: False
when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
- name: Update glibc if installed (yum)
yum: name=glibc state=latest
when: (ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux') and glibc.rc == 0
- name: Update glibc-common if installed (yum)
yum: name=glibc-common state=latest
when: (ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux') and glibc_common.rc == 0
@rdmarsh
Copy link

rdmarsh commented Feb 18, 2016

  • Triggers a [WARNING]: Consider using yum module rather than running yum under ansible 2.0.0.2 on the first command: yum line
  • (Ansible 2?): Isn't this better? "ansible_os_family": "RedHat",

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment