PT-2019-1709 · Red Hat · Ansible Tower

Published 2019-03-26 · Updated 2020-05-21 · CVE-2019-3869

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.4.3

Description The issue is related to the exposure of application credentials to playbook job runs via environment variables when running Ansible Tower on OpenShift or Kubernetes. This could allow a malicious user with the ability to write playbooks to gain administrative privileges. The vulnerability is also related to weaknesses in managing registration data in the Ansible Tower web interface, which could allow a remote attacker to elevate their privileges.

Recommendations For Ansible Tower versions prior to 3.4.3, update to version 3.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the playbook writing functionality to minimize the risk of exploitation. Additionally, restrict the use of environment variables in playbook job runs until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-255

CWE-214

Related Identifiers

BDU:2019-01321

CVE-2019-3869

RHSA-2019:0796

Affected Products

Ansible Tower

References · 6

• https://github.com/ansible/awx/pull/3505 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3869 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3869 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2019-3869 · Note