PT-2019-9380 · Red Hat · Ansible Tower

Borja Tarraso · Publicado 2019-01-03 · Atualizado 2023-02-03 · CVE-2018-16879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.3.3

Description The issue is related to the insecure configuration channel settings for messaging celery workers from RabbitMQ, which could lead to a data leak of sensitive information such as passwords and denial of service attacks by deleting projects or inventory files.

Recommendations For Ansible Tower versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider configuring a secure channel for messaging celery workers from RabbitMQ to minimize the risk of exploitation. Restrict access to sensitive information and projects to prevent potential data leaks and denial of service attacks.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2018-16879

Produtos afetados

Ansible Tower

Referências · 6

• https://t.me/cvenotify/6592 · Publicação no Telegram
• http://securityfocus.com/bid/106310 · Nota
• https://t.me/cvenotify/43513 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16879 · Nota de Segurança