DeutschShown in its original language — a full translation is planned for a future version.
Ansible Tower: Mehrere Schwachstellen
view advisory published 2019-12-16
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ansible Tower ausnutzen, um Informationen offenzulegen und um Sicherheitsmechanismen zu umgehen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-14864US | medium6.5 | — | ||
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callba… | ||||
| CVE-2019-19342US | medium5.3 | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would… | ||||
| CVE-2019-19341US | medium5.5 | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database… | ||||
| CVE-2019-19340US | high8.2OT elevated | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan