Important: Red Hat Security Advisory: Red Hat Ansible Tower 3.6.7-1 - Container security and bug fix update

Red Hat Ansible Tower 3.6.7-1 - RHEL7 Container Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: Red Hat Ansible Tower 3.7.5-1 - Container security and bug fix update

Red Hat Ansible Tower 3.7.5-1 - RHEL7 Container Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2021-20253: Files or Directories Accessible to External Parties

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality a...

PT-2021-13859 · Unknown · Ansible Tower

Name of the Vulnerable Software and Affected Versions: ansible-tower affected versions not specified Description: A flaw was found in the default installation of ansible-tower, allowing an attacker to elevate privileges from a low-privileged user to the awx user from outside the isolated...

CVE-2021-20253

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality a...

Red Hat ansible-tower 安全漏洞

Red Hat ansible-tower is an application from Red Hat USA. It provides role-based access control, including controlling the use of SSH and other services using securely stored credentials. A security vulnerability exists in ansible-tower that could be exploited by an attacker to elevate the...

RUSTSEC-2021-0135 Improper validation of Windows paths could lead to directory traversal attack

towerhttp::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.4-1 - RHEL7 Container Fixed two jQuery vulnerabilities CVE-2020-11022, CVE-2020-11023 Improved Ansible Tower's web service configuration to allow for processing more simultaneous HTTPs requests by default Updated several dependencies of Ansible Tower's User Interface to...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.6 runner release (CVE-2019-18874)

Red Hat Ansible Tower 3.6 runner release CVE-2019-18874 Updated python-psutil version to 5.6.6 inside ansible-runner container CVE-2019-18874...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7 runner release (CVE-2019-18874)

Red Hat Ansible Tower 3.7 runner release CVE-2019-18874 Updated python-psutil version to 5.6.6 inside ansible-runner container CVE-2019-18874...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container

Red Hat Ansible Tower 3.6.6-1 - RHEL7 Container Fixed an XSS vulnerability CVE-2020-25626 Fixed the Red Hat sosreport tool to no longer include the Ansible Tower SECRETKEY value Fixed the Ansible Tower installer so that it is now compatible with the latest supported Red Hat OpenShift Container...

Moderate: Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.3-1 - RHEL7 Container Updated to the latest version of the git-python library to no longer cause certain jobs to fail Updated to the latest version of the ovirt.ovirt collection to no longer cause connections to hang when syncing inventory from oVirt/RHV Added a number o...

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18 2.8.12 and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5 3.5.6 and 3.6.4 as well as previous versions are affected.

...

CVE-2020-14296

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery SSRF flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible...

Server side request forgery (ssrf)

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery SSRF flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible...

CVE-2020-14296

CVE-2020-14296 affects Red Hat CloudForms 4.7 and 5 with a Server-Side Request Forgery (SSRF) flaw exposed when adding an Ansible Tower provider. The issue allows an attacker to issue crafted requests from the vulnerable CloudForms server to scan or attack internal systems not normally accessible...

CVE-2020-14296

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery SSRF flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible...

CVE-2020-14296: Server-Side Request Forgery (SSRF)

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery SSRF flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible...

Server-Side Request Forgery (SSRF)

cfme is vulnerable to server-side request forgery SSRF. The vulnerability exists in Ansible Tower Provider...

Ansible Tower 3.x.x < 3.7.2 / 3.8.0 Data Exposure

The version of Ansible Tower running on the remote web server is 3.x.x prior to 3.7.2. It is, therefore, exposing data that can be mined by reviewing information in error results. A remote, unauthenticated attacker can exploit this by reviewing this information to gain user names and general site...