721 matches found
CVE-2020-14337: Generation of Error Message Containing Sensitive Information
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...
PT-2020-13975
Name of the Vulnerable Software and Affected Versions Tower affected versions not specified Description A data exposure flaw was found, allowing an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames, thus threatening data confidentiality...
CVE-2020-14337
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...
CVE-2020-14329
A data exposure flaw was found in Tower, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerabilit...
CVE-2020-14327
A Server-side request forgery SSRF flaw was found in Tower. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test featur...
CVE-2020-14328
A flaw was found in Ansible Tower. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest...
Automatic Visibility And Immediate Security with Trend Micro + AWS Control Tower
Things fail. It happens. A core principle of building well in the AWS Cloud is reliability. Dr. Vogels said it best, “How can you reduce the impact of failure on your customers?” He uses the term “blast radius” to describe this principle. One of the key methods for reducing blast radius is the AW...
PT-2020-5969
Name of the Vulnerable Software and Affected Versions Ansible version 3.7.0 Ansible Tower versions prior to 3.7.1 Description A flaw in the rsyslog configuration file was found, causing sensitive information such as tokens and secrets to be exposed due to incorrect world-readable permissions. Thi...
Red Hat Ansible Tower Information Disclosure Vulnerability
Red Hat Ansible is a computer system configuration manager from Red Hat. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and a REST API. An information disclosure...
Ansible Tower 3.6.x =< 3.6.3 Archive Traversal Arbitrary File Overwrite Vulnerability
The version of Ansible Tower running on the remote web server is 3.6.x equal or prior to 3.6.3. It is, therefore, affected by an archive traversal arbitrary file overwrite vulnerability when extracting tar.gz archives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
Ansible Tower 3.4.x =< 3.4.5 / 3.5.x =< 3.5.5 / 3.6.x =< 3.6.3 'k8s module' Information Disclosure Vulnerability
The version of Ansible Tower running on the remote web server is 3.4.x equal or prior to 3.4.5, or 3.5.x equal or prior to 3.5.5, or 3.6.x equal or prior to 3.6.3. It is, therefore, affected by an information disclosure vulnerability when managing kubernetes using the k8s module. %NASLMINLEVEL...
Unspecified Vulnerability in Red Hat Ansible Engine and Ansible Tower
Red Hat Ansible is a computer system configuration manager from Red Hat, USA. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and REST APIs.Ansible Engine is one of...
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
DEBIAN-CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
PYSEC-2020-208
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
PYSEC-2020-208
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
UBUNTU-CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....
Race condition
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....