CVE-2019-3869

CVE-2019-3869 affects Ansible Tower 3.x prior to 3.3.5 (and 3.4.x prior to 3.4.3) when running in OpenShift/Kubernetes, where Tower's credentials are exposed to playbook job runs via environment variables. This exposure could allow a user who can write playbooks to escalate to administrative priv...

CVE-2019-3869

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges...

CVE-2019-3869: Invocation of Process Using Visible Sensitive Information

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges...

(RHSA-2019:0652) Moderate: Red Hat Ansible Tower 3.3.5

For a list of changes included in this release, please read the Ansible Tower Release Notes: https://docs.ansible.com/ansible-tower/latest/html/release-notes/index.html...

(RHSA-2019:0651) Moderate: Red Hat Ansible Tower 3.4.3

For a list of changes included in this release, please read the Ansible Tower Release Notes: https://docs.ansible.com/ansible-tower/latest/html/release-notes/index.html...

PT-2019-1709

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.4.3 Description The issue is related to the exposure of application credentials to playbook job runs via environment variables when running Ansible Tower on OpenShift or Kubernetes. This could allow a maliciou...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

Default configuration

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

CVE-2018-16879

CVE-2018-16879 affects Ansible Tower 3.x prior to 3.3.3. The issue is a RabbitMQ misconfiguration where a secure channel is not used for messaging celery workers, enabling potential data leakage of sensitive information (e.g., passwords) and denial-of-service actions such as deletion of projects ...

CVE-2018-16879

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

PT-2019-9380 · Red Hat · Ansible Tower

Name of the Vulnerable Software and Affected Versions: Ansible Tower versions prior to 3.3.3 Description: The issue is related to the insecure configuration channel settings for messaging celery workers from RabbitMQ, which could lead to a data leak of sensitive information such as passwords and...

CVE-2018-16879: Missing Encryption of Sensitive Data

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting...

Ansible Tower Information Disclosure Vulnerability (CNVD-2018-26916)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Ansible Tower a.k.a. Ansible UI is one of the task control applications that provides a user interface UI, dashboard, and REST API. An information disclosure...

CVE-2018-16879

Tower does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files...

(RHSA-2018:3505) Critical: Red Hat Ansible Tower 3.3.1-2 Release - Container Image

Red Hat Ansible Tower 3.3.1 is now available and contains the following bug fixes: - Fixed event callback error when in-line vaulted variables are used with includevars - Fixed HSTS and X-Frame-Options to properly be set in nginx configuration - Fixed isolated node setup to no longer fail when...

Ansible Tower Privilege Access Control Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Ansible Tower a.k.a. Ansible UI is one of the task control applications that provides a user interface UI, dashboard, and REST API. A privilege access contro...

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database...

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database...