fix_shellshock.yml

---

- hosts: all
  tasks:
    - name: check if vulnerable
      command:
        env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
      register: res
      always_run: yes

    - name: stop if not vulnerable
      fail:
        msg="not vulnerable"
      when: "'vulnerable' not in res.stdout"

    # For Debian Squeeze, the fixed bash package is provided by squeeze-lts
    # https://wiki.debian.org/LTS/Using
    - name: ensure we have the latest version of debian keyring
      apt:
        name={{item}}
        state=latest
        force=yes
      with_items:
        - debian-keyring
        - debian-archive-keyring
      when: ansible_distribution=='Debian' and ansible_distribution_major_version=='6'

    - name: setup squeeze-lts repository
      apt_repository:
        repo='deb http://http.debian.net/debian squeeze-lts main contrib non-free'
        state=present
        update_cache=yes
      when: ansible_distribution=='Debian' and ansible_distribution_major_version=='6'

    - name: install latest version of bash (Debian)
      apt:
        name=bash
        state=latest
        update_cache=yes
      when: ansible_os_family=='Debian'

    - name: install latest version of bash (RedHat)
      yum:
        name=bash
        state=latest
      when: ansible_os_family=='RedHat'

# vi: set ft=ansible :