gistfile1.txt

# running version=latest is great to solve the immediate vulnerability,
# but becomes slow with continuous deployment. Here's our solution,
# made easier by our hetrogenous environment.

- name: update apt cache if not done today
  apt: update_cache=yes cache_valid_time=86400
- name: install standard dependencies
  apt: pkg={{item}} force=yes state=present
  with_items:
    # http://seclists.org/oss-sec/2014/q3/650
    - bash=4.2-2ubuntu2.2
# https://gist.github.com/kacy/2b9408af04c71fab686e
- name: ensure bash is not vulnerable to 201409 problem
  command: env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
  register: command_result
  failed_when: "'error' not in command_result.stderr"