PT-2018-5372 · Red Hat · Ansible Tower

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-12148

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.5 Ansible Tower versions prior to 3.2.0

Description A flaw was found in Ansible Tower's interface with SCM repositories. If a Tower project definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook. This playbook, when executed by Tower, could modify the checked out SCM repository to add git hooks, potentially leading to arbitrary command and code execution as the user Tower runs as.

Recommendations For Ansible Tower versions prior to 3.1.5, update to version 3.1.5 or later. For Ansible Tower versions prior to 3.2.0, update to version 3.2.0 or later. As a temporary workaround, consider setting the 'delete before update' flag for all Tower project definitions to prevent exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12148

RHSA-2017:3005

Affected Products

Ansible Tower

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12148 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12148 · Security Note
• https://access.redhat.com/errata/RHSA-2017:3005 · Vendor Advisory