Red Hat Security Advisory: Red Hat Ansible Tower 3.6.2-1 - RHEL7 Container
Red Hat Ansible Tower 3.6.2-1 - RHEL7 Container
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-19342US | medium5.3 | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would… | ||||
| CVE-2019-19341US | medium5.5 | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database… | ||||
| CVE-2019-19340US | high8.2OT elevated | — | ||
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2019:4243self
- https://access.redhat.com/security/updates/classification/#importantexternal
- 1782623external
- 1782624external
- 1782625external
- Canonical URLself
remediations (5)
- Fixedansible-tower-36/ansible-tower@sha256:dcaf6e0914afb8cecf1962fbc1d6afa5a132f85ea20f56e18102310ad11515b5_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2019:4243 - Fixedansible-tower-36/ansible-tower@sha256:dcaf6e0914afb8cecf1962fbc1d6afa5a132f85ea20f56e18102310ad11515b5_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2019:4243 - Fixedansible-tower-36/ansible-tower@sha256:dcaf6e0914afb8cecf1962fbc1d6afa5a132f85ea20f56e18102310ad11515b5_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2019:4243 - Workaroundansible-tower-36/ansible-tower@sha256:dcaf6e0914afb8cecf1962fbc1d6afa5a132f85ea20f56e18102310ad11515b5_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7
The issue could be mitigated by limiting the access of the interface to internal trusted networks, limiting the ports open and set the firewall with more restrictive rules. Some of these instructions are already suggested in the Ansible Tower documentation as part of the Ansible Tower Administration Guide. Issue could be also mitigated by deleting the guest default user by running the command "rabbitmqctl delete_user guest".
- Workaroundansible-tower-36/ansible-tower@sha256:dcaf6e0914afb8cecf1962fbc1d6afa5a132f85ea20f56e18102310ad11515b5_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7
This issue could be mitigated by setting or changing the RabbitMQ passwords without using the specials characters. Complex passwords could still remain or even increase by using unpredictable longer strings. This adds much more entropy rather than just using special characters in shorter strings.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan