MAL-015

MAL-015：Ansible Tower 中的隔离逃逸 2 在特定 Rhel 7/8 配置上的 Ansible Tower 安装可能容易受到“作业隔离”逃逸的影响，该逃逸允许攻击者从隔离环境外部提升到“awx”用户。 在 CVE-2021-20253 被修复后，攻击者可以利用以下文件/配置来执行作业隔离逃逸漏洞： 文件“/var/spool/mail/awx”： 如果目标上安装了 SMTP 服务器，攻击者可以创建该文件 也可能由“useradd”等程序创建（如果使用自定义的 awx 用户） 在 Rhel 7 或更低版本中，为了安装 AWX，需要安装运行时版本的...

CVE-2021-20253

CVE-2021-20253: Ansible Tower 中通过作业隔离逃逸实现权限提升 在 ansible-tower 中发现了一个缺陷。默认安装容易受到作业隔离逃逸的影响，允许攻击者从隔离环境外部将权限从低权限用户提升到 awx 用户。此漏洞的最大威胁在于数据机密性、完整性以及系统可用性。 供应商披露： 该漏洞的供应商披露和修复方法可在此处找到：此处。 要求： 此漏洞需要： 能够在 Ansible Tower 的隔离环境中执行命令 具有对操作系统的低权限访问 概念验证： 更多详细信息和利用过程可在此 PDF 中找到。...

EUVD-2021-33992

Malicious code in bioql PyPI...

CVE-2021-4112

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...

Default configuration

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...

CVE-2021-4112

CVE-2021-4112 affects Red Hat Ansible Automation Platform (ansible-runner). The issue is described as a privilege escalation via job isolation escape that could elevate a low-privilege user to an AWX user from outside the isolated environment. Public details in connected documents identify the vu...

PT-2022-11367 · Unknown · Ansible Tower

Name of the Vulnerable Software and Affected Versions: ansible-tower affected versions not specified Description: A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged use...

Privilege Escalation

ansible-runner is vulnerable to privilege escalation. A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment...

Red Hat Ansible 权限许可和访问控制问题漏洞

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to publish, manage, and organize computer systems. A privilege permission and access control issue vulnerability exists in Red Hat Ansible Tower, which stems from an error in the...

CVE-2021-20253

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality a...

CVE-2021-20253

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality a...

PT-2021-13859 · Unknown · Ansible Tower

Name of the Vulnerable Software and Affected Versions: ansible-tower affected versions not specified Description: A flaw was found in the default installation of ansible-tower, allowing an attacker to elevate privileges from a low-privileged user to the awx user from outside the isolated...