PT-2019-9380 · Red Hat · Ansible Tower

Borja Tarraso · Published 2019-01-03 · Updated 2023-02-03 · CVE-2018-16879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.3.3

Description The issue is related to the insecure configuration channel settings for messaging celery workers from RabbitMQ, which could lead to a data leak of sensitive information such as passwords and denial of service attacks by deleting projects or inventory files.

Recommendations For Ansible Tower versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider configuring a secure channel for messaging celery workers from RabbitMQ to minimize the risk of exploitation. Restrict access to sensitive information and projects to prevent potential data leaks and denial of service attacks.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-16879

Affected Products

Ansible Tower

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16879 · Security Note
• https://t.me/cvenotify/6592 · Telegram Post
• http://securityfocus.com/bid/106310 · Note
• https://t.me/cvenotify/43513 · Telegram Post