ansible-playbook -i "localhost," -c local --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# 'l' für lokal auswählen

ansible-playbook -i "localhost," -c local --ask-become-pass revert_cve_2026_31431.yml -v

ansible-playbook -i "192.168.1.100," -u ubuntu --ask-become-pass check_cve_2026_31431.yml -v

[servers]
192.168.1.100
192.168.1.101

ansible-playbook -i hosts.ini --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# 'l' für lokal auswählen

docker run -it --privileged ubuntu:22.04 /bin/bash
# Innerhalb des Containers:
apt update && apt install -y ansible python3
# Playbook in den Container kopieren oder curl/wget verwenden
ansible-playbook -i "localhost," -c local check_cve_2026_31431.yml -v

docker run -it --privileged -v $(pwd)/check_cve_2026_31431.yml:/check.yml ubuntu:22.04
# Innerhalb: ansible-playbook -i "localhost," -c local /check.yml -v

name: Check CVE-2026-31431

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  check-vulnerability:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build test image
        run: docker build -t test-image .

      - name: Check for CVE-2026-31431 in container
        run: |
          docker run --rm \
            -v ${{ github.workspace }}/check_cve_2026_31431.yml:/check.yml \
            test-image \
            /bin/bash -c "apt update && apt install -y ansible python3 && \
            echo 'no' | ansible-playbook -i 'localhost,' -c local /check.yml -v"

      - name: Fail if vulnerable
        run: |
          # Das Playbook muss != 0 zurückgeben, wenn verwundbar
          # Oder die Ausgabe nach "VULNERABLE" durchsuchen

stages:
  - build
  - security

build_image:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

check_cve:
  stage: security
  script:
    - docker run --rm -v $(pwd)/check_cve_2026_31431.yml:/check.yml $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      /bin/bash -c "apt-get update && apt-get install -y ansible python3 && 
      ansible-playbook -i 'localhost,' -c local /check.yml -v | grep -q 'SAFE' || exit 1"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y ansible python3 wget

# Prüfung während des Builds kopieren und ausführen
COPY check_cve_2026_31431.yml /tmp/
RUN echo "no" | ansible-playbook -i "localhost," -c local /tmp/check_cve_2026_31431.yml -v | \
    grep -q "SAFE" || (echo "VULNERABLE - Fix before building" && exit 1)

# Rest deines Images...

Status: SAFE - System is protected