ubuntu_fix_CVE-2014-6271.yml

- name: Apply Upgrade for bash vulnerability in Ubuntu
  hosts: all
  sudo: yes
  tasks:

    - name: Check if we are vulnerable
      shell: executable=/bin/bash chdir=/tmp foo='() { echo vulnerable; }' bash -c foo
      register: test_vuln
      ignore_errors: yes

    - name: Apply bash security update if we are vulnerable
      apt: name=bash state=latest update_cache=true
      when: "'vulnerable' in test_vuln.stdout"

    - name: Check again and fail if we are still vulnerable
      shell: executable=/bin/bash chdir=/tmp foo='() { echo vulnerable; }' bash -c foo
      when: "'vulnerable' in test_vuln.stdout"
      register: test_again
      ignore_errors: yes
      failed_when: "'vulnerable' in test_again.stdout"