PT-2019-4198 · Red Hat · Ansible Tower

Publicado 2019-11-26 · Atualizado 2019-12-17 · CVE-2019-14890

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.6.1

Description A vulnerability allows an attacker with low privilege to retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database. This issue is related to the unencrypted storage of sensitive information in the /api/v2/config endpoint. Exploitation of this issue may allow an attacker to gain unauthorized access to application user passwords.

Recommendations For Ansible Tower versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /api/v2/config endpoint to minimize the risk of exploitation. Avoid using the RHSM credentials in the affected API endpoint until the issue is resolved.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

BDU:2019-04794

CVE-2019-14890

Produtos afetados

Ansible Tower

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-14890 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2019-14890 · Nota
• https://bdu.fstec.ru/vul/2019-04794 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14890 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14890 · Nota de Segurança