CloudForms: Server-Side Request Forgery (SSRF) in Ansible Tower Provider

A Server-Side Request Forgery flaw was found in Red Hat CloudForms where malicious requests can be sent from the vulnerable server. An attacker with the privileges to add Ansible Tower provider could inject URLs with port details or with internal IPs to observe internal network...

Moderate: Red Hat Security Advisory: Red Hat Ansible Tower 3.6.5-1 - RHEL7 Container

Red Hat Ansible Tower 3.6.5-1 - RHEL7 Container Removed reports option for Satellite inventory script Fixed Tower Server Side Request Forgery on Credentials CVE-2020-14327 Fixed the Job Type field to render properly when editing a Job Template Fixed a notable delay running large project update...

Moderate: Red Hat Security Advisory: Red Hat Ansible Tower 3.7.2-1 - RHEL7 Container

Red Hat Ansible Tower 3.7.2-1 - RHEL7 Container Updated Named URLs to allow for testing the presence or absence of objects CVE-2020-14337 Fixed Tower Server Side Request Forgery on Credentials CVE-2020-14327 Fixed Tower Server Side Request Forgery on Webhooks CVE-2020-14328 Fixed Tower sensitive...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

Design/Logic Flaw

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14337

CVE-2020-14337 affects Ansible Tower/Tower, where a data exposure flaw allows an unauthenticated, remote attacker to glean data by error results. Reports describe that HTTP error responses can reveal pages from the default organization and verification of usernames. The issue is associated with T...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14337: Generation of Error Message Containing Sensitive Information

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data...

CVE-2020-14329

A data exposure flaw was found in Tower, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerabilit...

CVE-2020-14328

A flaw was found in Ansible Tower. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest...

CVE-2020-14327

A Server-side request forgery SSRF flaw was found in Tower. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test featur...

Automatic Visibility And Immediate Security with Trend Micro + AWS Control Tower

Things fail. It happens. A core principle of building well in the AWS Cloud is reliability. Dr. Vogels said it best, “How can you reduce the impact of failure on your customers?” He uses the term “blast radius” to describe this principle. One of the key methods for reducing blast radius is the AW...

Red Hat Ansible Tower Information Disclosure Vulnerability

Red Hat Ansible is a computer system configuration manager from Red Hat. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and a REST API. An information disclosure...

Ansible Tower 3.6.x =< 3.6.3 Archive Traversal Arbitrary File Overwrite Vulnerability

The version of Ansible Tower running on the remote web server is 3.6.x equal or prior to 3.6.3. It is, therefore, affected by an archive traversal arbitrary file overwrite vulnerability when extracting tar.gz archives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Ansible Tower 3.4.x =< 3.4.5 / 3.5.x =< 3.5.5 / 3.6.x =< 3.6.3 'k8s module' Information Disclosure Vulnerability

The version of Ansible Tower running on the remote web server is 3.4.x equal or prior to 3.4.5, or 3.5.x equal or prior to 3.5.5, or 3.6.x equal or prior to 3.6.3. It is, therefore, affected by an information disclosure vulnerability when managing kubernetes using the k8s module. %NASLMINLEVEL...

Unspecified Vulnerability in Red Hat Ansible Engine and Ansible Tower

Red Hat Ansible is a computer system configuration manager from Red Hat, USA. The product can be used to publish, manage, and orchestrate computer systems.Ansible Tower is one of the mission control applications that provides a user interface UI, dashboards, and REST APIs.Ansible Engine is one of...

CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....

DEBIAN-CVE-2020-10744

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9....