CVE-2014-125030 (YAML, published 2023-01-01T09:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation leads to use of hard-coded password. The patch is identified as 557e177d8a309d6f0f26de46efb38d43e000852d. It is recommended to apply a patch to fix this issue. VDB-217154 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/taoeffect/empress
Files changed:
Vagrantfile
roles/common/handlers/main.yml
roles/common/tasks/security.yml
roles/ssh/README.md
roles/ssh/handlers/main.yml
roles/ssh/tasks/main.yml
site.yml
test.yml
vars/testing.yml
Commit message: Add digitalocean as a provider for vagrant

I've got a slow-ass laptop, so deploying to digitalocean is faster, and
cheap enough that I don't care.

This sets some default passwords, which makes the box vulnerable, but
the machine is short-lived and has no sensitive information so it
shouldn't matter. Long-term, this should be fixed somehow.


Vulnerable code:
    ansible.playbook = "site.yml"
    ansible.extra_vars = { ansible_ssh_user: "vagrant", testing: true }
    # ansible.verbose = "vvvv"

- name: restart ssh
  service: name=ssh state=restarted

- name: Update sshd config to disallow root logins
  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
  notify: restart ssh
    - vars/{{ 'testing' if testing is defined else 'user' }}.yml

Fixed code:
    ansible.playbook = "test.yml"
    ansible.extra_vars = { testing: true }
    ansible.verbose = "vvvv"
  config.vm.provider :digital_ocean do |provider, override|
    override.ssh.private_key_path = "~/.ssh/id_rsa"
    override.vm.box = "digital_ocean"
    override.vm.box_url = "https://github.com/smdahlen/vagrant-digitalocean/raw/master/box/digital_ocean.box"

    provider.ssh_key_name = "TODO"
    provider.token = "TODO"
    provider.image = "debian-7-0-x64"
    provider.region = "nyc3"
    provider.size = "512mb"
  end

empress.ssh
===========

Disables ssh `root` login. This improves security, but may get in the way if you
aren't using a `deploy` user.

Eventually, this should provide a number of common configurable tweaks for ssh,
like disabling password auth.
---
- name: restart ssh
  service: name=ssh state=restarted
---
- name: Update sshd config to disallow root logins
  lineinfile: dest=/etc/ssh/sshd_config regexp=^PermitRootLogin line="PermitRootLogin no" state=present
  notify: restart ssh
    - vars/user.yml
    - ssh
---
# Installs all the stuff that makes sense to use together for testing purposes
# eventually we may want to have multiple implementations of this to test common
# setups, eg. different vagrant configs for different sql backends.

- hosts: all
  # user should be defined by vagrant
  sudo: True
  gather_facts: True
  vars_files:
    - vars/defaults.yml
    - vars/testing.yml

  roles:
    - common
    - mailserver
    - tarsnap
    # - mailpile # fix this
testing: true