Subject: [ansible-devel] Ansible 2.7.8, 2.6.14, and 2.5.15

Hi all- we're happy to announce that the general release of Ansible
2.7.8, Ansible 2.6.14, and Ansible 2.5.15 are now ready to be
How do you get it?

$ pip install ansible==2.7.8 --user
$ pip install ansible==2.6.14 --user
$ pip install ansible==2.5.15 --user

The tar.gz of the release can be found here:

* 2.7.8
  SHA256: 3d67db258b492f3c8828c68dcb92438e67cb5b20c12924089eafdc0ada3edd87
* 2.6.14
  SHA256: 412f130f4c5d1953ccd95f01b5a4675cbff4ba225762bafb74a2f3bb6c807827
* 2.5.15
  SHA256: ffbc2b093290c72a0a79be457ba47c57ecce7f32d65418fadc064ba1c3763cf1

What's new in 2.7.8, 2.6.14, and 2.5.15?

These releases are maintenance releases containing numerous bugfixes.
Of special note is that these releases fix CVE-2019-3828 where a
compromised remote machine could cause ansible's fetch module to
overwrite files on the Ansible controller.  The full changelog is at:

* 2.7.8
* 2.6.14
* 2.5.15

What's the schedule for future maintenance releases?

Ansible 2.5 is in security fix-only mode so there will only be another
release if it's needed to fix a security bug.  Ansible 2.6 and Ansible
2.7 have maintenance releases approximately every 3 weeks.  So expect
the next one around March 14th.
We've published a porting guide at
to help migrate your content to 2.7. If you discover any errors, or if
you see any regressions from playbooks which work on 2.7.7 and prior,
please open a GitHub issue, and be sure to mention you're using 2.7.8.


-Toshio Kuratomi