Red Hat Security Advisory: security update - Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container
Red Hat Ansible Tower 3.7.1-1 - RHEL7 Container
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-10782US | medium6.5OT erhöht | — | ||
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog co… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Behobenansible-tower-37/ansible-tower-rhel7@sha256:aa09402740bacddc9ddc3be4fcee4b7d5ec4698553c787ab50eff97ade9d8c13_amd64 as a component of Red Hat Ansible Tower 3.7 for RHEL 7
For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html
https://access.redhat.com/errata/RHSA-2020:2617 - Workaroundansible-tower-37/ansible-tower-rhel7@sha256:aa09402740bacddc9ddc3be4fcee4b7d5ec4698553c787ab50eff97ade9d8c13_amd64 as a component of Red Hat Ansible Tower 3.7 for RHEL 7
Setting manual permissions for the rsyslog.conf file to 0640 would mitigate the issue temporarily. However, be aware that every time the Tower services are restarted, the permissions are restored to 644 after some time.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan