CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

CVE-2017-12148: Improper Input Validation

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

PT-2018-5372

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.5 Ansible Tower versions prior to 3.2.0 Description A flaw was found in Ansible Tower's interface with SCM repositories. If a Tower project definition does not have the 'delete before update' flag set, an...

PT-2017-3414

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.4.1 Description The issue is related to the execution of arbitrary code through a specially malformed repository. This can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update...

Tower: modification of git hooks in SCM repo via upstream playbook execution

A flaw was found in Tower's interface with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower,...

CVE-2017-15041

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...

PT-2017-13829

Name of the Vulnerable Software and Affected Versions Go versions 1.8.0 through 1.8.3 Go versions 1.9.0 through 1.9.0 Description The issue allows remote command execution through the "go get" command. By using custom domains, an attacker can trick "go get" into reusing a Git checkout from a...

CVE-2017-15041: Undefined Security Weakness

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...

CVE-2017-12148

A flaw was found in Tower's interface with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower,...