Lucene search

K

Ansible-tower Security Vulnerabilities

cve
cve

CVE-2022-3248

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be...

7.5CVSS

7.3AI Score

0.0005EPSS

2023-10-05 02:15 PM
34
cve
cve

CVE-2021-4112

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated...

8.8CVSS

8.2AI Score

0.0004EPSS

2022-08-25 08:15 PM
59
5
cve
cve

CVE-2021-3583

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters....

7.1CVSS

6.8AI Score

0.0004EPSS

2021-09-22 12:15 PM
118
2
cve
cve

CVE-2020-14328

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in...

3.3CVSS

4AI Score

0.0004EPSS

2021-05-27 08:15 PM
35
cve
cve

CVE-2020-14327

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of...

5.5CVSS

5.4AI Score

0.0004EPSS

2021-05-27 08:15 PM
40
cve
cve

CVE-2020-14329

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The...

3.3CVSS

3.8AI Score

0.0004EPSS

2021-05-27 08:15 PM
34
cve
cve

CVE-2020-10697

A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case...

4.4CVSS

4.5AI Score

0.0004EPSS

2021-05-27 07:15 PM
37
4
cve
cve

CVE-2020-10709

A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to...

7.1CVSS

6.7AI Score

0.0004EPSS

2021-05-27 07:15 PM
34
6
cve
cve

CVE-2020-10698

A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when....

3.3CVSS

3.9AI Score

0.0004EPSS

2021-05-27 07:15 PM
36
3
cve
cve

CVE-2021-20191

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to...

5.5CVSS

5.9AI Score

0.0004EPSS

2021-05-26 09:15 PM
158
3
cve
cve

CVE-2021-20178

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this...

5.5CVSS

6AI Score

0.0005EPSS

2021-05-26 12:15 PM
136
2
cve
cve

CVE-2021-20228

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability....

7.5CVSS

7AI Score

0.003EPSS

2021-04-29 04:15 PM
121
6
cve
cve

CVE-2021-3447

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An...

5.5CVSS

5.2AI Score

0.0005EPSS

2021-04-01 06:15 PM
110
3
cve
cve

CVE-2021-20253

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality...

6.7CVSS

6.3AI Score

0.0004EPSS

2021-03-09 06:15 PM
63
5
cve
cve

CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw.....

7.1CVSS

6.9AI Score

0.0004EPSS

2020-09-23 01:15 PM
154
4
cve
cve

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

5.8CVSS

5.6AI Score

0.001EPSS

2020-07-31 01:15 PM
31
cve
cve

CVE-2020-10782

An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to....

6.5CVSS

6.1AI Score

0.0004EPSS

2020-06-18 01:15 PM
42
cve
cve

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and...

5CVSS

5.8AI Score

0.001EPSS

2020-05-15 02:15 PM
105
2
cve
cve

CVE-2020-1746

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue...

5CVSS

5.6AI Score

0.0005EPSS

2020-05-12 06:15 PM
189
5
cve
cve

CVE-2020-10685

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script,...

5.5CVSS

5.8AI Score

0.0004EPSS

2020-05-11 02:15 PM
145
4
cve
cve

CVE-2020-10691

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file...

5.2CVSS

5AI Score

0.0004EPSS

2020-04-30 05:15 PM
129
cve
cve

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS.....

5.6CVSS

6AI Score

0.0005EPSS

2020-03-31 05:15 PM
207
cve
cve

CVE-2020-10684

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take...

7.9CVSS

7.1AI Score

0.0004EPSS

2020-03-24 02:15 PM
135
6
cve
cve

CVE-2020-1740

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and...

4.7CVSS

5.2AI Score

0.0005EPSS

2020-03-16 04:15 PM
153
4
cve
cve

CVE-2020-1738

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x...

3.9CVSS

4AI Score

0.0005EPSS

2020-03-16 04:15 PM
81
cve
cve

CVE-2020-1735

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be...

4.6CVSS

5.2AI Score

0.001EPSS

2020-03-16 04:15 PM
147
4
cve
cve

CVE-2020-1736

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions...

3.3CVSS

3.6AI Score

0.001EPSS

2020-03-16 04:15 PM
104
cve
cve

CVE-2020-1753

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl.....

5.5CVSS

5.9AI Score

0.0005EPSS

2020-03-16 03:15 PM
145
5
cve
cve

CVE-2020-1739

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from...

3.9CVSS

5.5AI Score

0.0005EPSS

2020-03-12 06:15 PM
182
5
cve
cve

CVE-2020-1733

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask.....

5CVSS

5.8AI Score

0.001EPSS

2020-03-11 07:15 PM
182
3
cve
cve

CVE-2020-1737

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive...

7.8CVSS

7AI Score

0.0004EPSS

2020-03-09 04:15 PM
186
cve
cve

CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...

7.4CVSS

7.3AI Score

0.0004EPSS

2020-03-03 10:15 PM
103
cve
cve

CVE-2019-14864

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive...

6.5CVSS

6.4AI Score

0.003EPSS

2020-01-02 03:15 PM
244
4
cve
cve

CVE-2019-19342

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose...

5.3CVSS

5.5AI Score

0.001EPSS

2019-12-19 09:15 PM
133
cve
cve

CVE-2019-19341

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every...

5.5CVSS

5.5AI Score

0.0004EPSS

2019-12-19 09:15 PM
125
cve
cve

CVE-2019-19340

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could.....

8.2CVSS

8.1AI Score

0.002EPSS

2019-12-19 09:15 PM
150
cve
cve

CVE-2019-14890

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower...

8.4CVSS

8.2AI Score

0.0004EPSS

2019-11-26 07:15 AM
98
cve
cve

CVE-2019-14858

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are...

5.5CVSS

5.4AI Score

0.0005EPSS

2019-10-14 03:15 PM
203
cve
cve

CVE-2019-10310

A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials...

8.8CVSS

8.4AI Score

0.002EPSS

2019-04-30 01:29 PM
40
cve
cve

CVE-2019-10312

A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in...

4.3CVSS

4.4AI Score

0.001EPSS

2019-04-30 01:29 PM
34
cve
cve

CVE-2019-10311

A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials....

8.8CVSS

8.5AI Score

0.003EPSS

2019-04-30 01:29 PM
33
cve
cve

CVE-2019-3869

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative...

7.2CVSS

7.1AI Score

0.001EPSS

2019-03-28 02:29 PM
60
cve
cve

CVE-2019-3838

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by...

5.5CVSS

5.6AI Score

0.002EPSS

2019-03-25 07:29 PM
195
cve
cve

CVE-2019-3835

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by...

5.5CVSS

6.3AI Score

0.002EPSS

2019-03-25 07:29 PM
203
cve
cve

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

9.8CVSS

9.1AI Score

0.002EPSS

2019-01-03 02:29 PM
37
cve
cve

CVE-2018-16837

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to....

7.8CVSS

5.4AI Score

0.001EPSS

2018-10-23 03:29 PM
202
cve
cve

CVE-2018-1000805

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network...

8.8CVSS

8.5AI Score

0.004EPSS

2018-10-08 03:29 PM
392
cve
cve

CVE-2018-17456

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-'...

9.8CVSS

9.3AI Score

0.17EPSS

2018-10-06 02:29 PM
538
2
cve
cve

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the...

8CVSS

8AI Score

0.0004EPSS

2018-09-11 01:29 PM
26
cve
cve

CVE-2017-7528

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using...

6.5CVSS

6.4AI Score

0.001EPSS

2018-08-22 04:29 PM
30
Total number of security vulnerabilities68