Important: Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container

Red Hat Ansible Tower 3.8.4-1 - Container Running inventories of 60k hosts no longer takes a very long time for events to show up Removed artifactdata from data sent to analytics as part of playbookonstats, since artifactdata can contain PII or sensitive data Regular users are no longer...

AWS Marketplace Talks Secure Digital Transformation

Spurred on by the pandemic, digital transformation continues to accelerate. Chris Grusz, director of AWS Marketplace and Control Tower, discusses how security teams can leverage this transformation to securely innovate and drive better business outcomes...

Privilege Escalation

ansible-tower is vulnerable to privilege escalation. The vulnerability exists due to application credentials exposed to playbook job runs via environment variables...

PYSEC-2021-126

A flaw was found in Ansible if an ansible user sets ANSIBLEASYNCDIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async...

PYSEC-2021-125

A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...

CVE-2021-3533

Rejected reason: This vulnerability does not meet the criteria for a security vulnerability...

PYSEC-2021-125

A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...

CVE-2021-3533

CVE-2021-3533 refers to a race condition in Ansible’s async code that could allow a local authenticated attacker to obtain sensitive information. Connected sources identify affected products as Ansible Tower 3.7 and Ansible Automation Platform 1.2, with exploitation tied to setting the ANSIBLE AS...

CVE-2021-3533

Removed by vendor...

CVE-2021-3532

CVE-2021-3532 entry is corroborated by connected documents indicating a data leak in Ansible where secret information in async_files can be disclosed when the jobdir is changed to a world-readable directory. The vulnerability affects Ansible Tower 3.7 and Ansible Automation Platform 1.2, and is d...

CVE-2021-3532

Removed by vendor...

PT-2021-20890 · Red Hat · Ansible Automation Platform +2

Name of the Vulnerable Software and Affected Versions: Ansible Tower version 3.7 Ansible Automation Platform version 1.2 Description: A flaw was found in Ansible related to the setting of the ANSIBLE ASYNC DIR variable to a subdirectory of a world-writable directory, leading to a race condition o...

PT-2021-28360

Name of the Vulnerable Software and Affected Versions: Ansible Tower version 3.7 Ansible Automation Platform version 1.2 Description: A flaw in Ansible discloses secret information in async files when the jobdir is changed to a world-readable directory. This allows a malicious user to read any...

py-ansible -- data leak vulnerability

Tapas jena reports: A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw...

Red Hat Ansible Information Disclosure Vulnerability (CNVD-2021-39044)

Red Hat Ansible is a computer system configuration manager from Red Hat. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and a REST API. An information disclosure...

Red Hat Ansible Code Issue Vulnerability

Red Hat Ansible is a computer system configuration manager from Red Hat. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and a REST API. A code issue vulnerability...

Red Hat Ansible Code Issue Vulnerability (CNVD-2021-39042)

Red Hat Ansible is a computer system configuration manager from Red Hat. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and a REST API. A code issue vulnerability...

CVE-2020-14329

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The...

CVE-2020-14327

A Server-side request forgery SSRF flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of...

CVE-2020-14328

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in ca...