csaf_redhat - RHSA-2022:0460

RHSA-2022:0460

Vulnerability from csaf_redhat

Published

2022-02-08 03:43

Modified

2024-11-22 18:22

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 ansible-runner security update

Notes

Topic

An update is now available for ansible-runner for Red Hat Ansible Automation Platform 2.1 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * Ansible: ansible-runner: Privilege escalation via job isolation escape (CVE-2021-4112) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for ansible-runner for Red Hat Ansible Automation Platform 2.1\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nSecurity Fix(es):\n\n* Ansible: ansible-runner: Privilege escalation via job isolation escape (CVE-2021-4112)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0460",
        "url": "https://access.redhat.com/errata/RHSA-2022:0460"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2028121",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028121"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0460.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 ansible-runner security update",
    "tracking": {
      "current_release_date": "2024-11-22T18:22:18+00:00",
      "generator": {
        "date": "2024-11-22T18:22:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2022:0460",
      "initial_release_date": "2022-02-08T03:43:23+00:00",
      "revision_history": [
        {
          "date": "2022-02-08T03:43:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-08T03:43:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T18:22:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.1 for RHEL 8",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.1 for RHEL 8",
                  "product_id": "8Base-Ansible-Automation-Platform-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:2.1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-runner-0:2.1.1-2.el8ap.src",
                "product": {
                  "name": "ansible-runner-0:2.1.1-2.el8ap.src",
                  "product_id": "ansible-runner-0:2.1.1-2.el8ap.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-runner@2.1.1-2.el8ap?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-runner-0:2.1.1-2.el8ap.noarch",
                "product": {
                  "name": "ansible-runner-0:2.1.1-2.el8ap.noarch",
                  "product_id": "ansible-runner-0:2.1.1-2.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-runner@2.1.1-2.el8ap?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python38-ansible-runner-0:2.1.1-2.el8ap.noarch",
                "product": {
                  "name": "python38-ansible-runner-0:2.1.1-2.el8ap.noarch",
                  "product_id": "python38-ansible-runner-0:2.1.1-2.el8ap.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python38-ansible-runner@2.1.1-2.el8ap?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-runner-0:2.1.1-2.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.1 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.noarch"
        },
        "product_reference": "ansible-runner-0:2.1.1-2.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-runner-0:2.1.1-2.el8ap.src as a component of Red Hat Ansible Automation Platform 2.1 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.src"
        },
        "product_reference": "ansible-runner-0:2.1.1-2.el8ap.src",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python38-ansible-runner-0:2.1.1-2.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.1 for RHEL 8",
          "product_id": "8Base-Ansible-Automation-Platform-2.1:python38-ansible-runner-0:2.1.1-2.el8ap.noarch"
        },
        "product_reference": "python38-ansible-runner-0:2.1.1-2.el8ap.noarch",
        "relates_to_product_reference": "8Base-Ansible-Automation-Platform-2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Matei Mal Badanoiu"
          ],
          "organization": "Deloitte Romania"
        }
      ],
      "cve": "CVE-2021-4112",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-12-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2028121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible-tower: Privilege escalation via job isolation escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.noarch",
          "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.src",
          "8Base-Ansible-Automation-Platform-2.1:python38-ansible-runner-0:2.1.1-2.el8ap.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4112"
        },
        {
          "category": "external",
          "summary": "RHBZ#2028121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4112",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4112"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4112",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4112"
        }
      ],
      "release_date": "2021-12-01T14:02:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-08T03:43:23+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.1:python38-ansible-runner-0:2.1.1-2.el8ap.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0460"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.1:python38-ansible-runner-0:2.1.1-2.el8ap.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.noarch",
            "8Base-Ansible-Automation-Platform-2.1:ansible-runner-0:2.1.1-2.el8ap.src",
            "8Base-Ansible-Automation-Platform-2.1:python38-ansible-runner-0:2.1.1-2.el8ap.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ansible-tower: Privilege escalation via job isolation escape"
    }
  ]
}

cve-2021-4112

Vulnerability from cvelistv5

Published

2022-08-25 19:35

Modified

2024-08-03 17:16

Severity ?

Summary

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=2028121	x_refsource_MISC
	https://access.redhat.com/security/cve/CVE-2021-4112	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

ansible-tower

Version: Fixed in ansible-tower 3.8.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:04.236Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028121"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-4112"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ansible-tower",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in ansible-tower 3.8.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 - Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-25T19:35:45",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2028121"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2021-4112"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-4112",
    "datePublished": "2022-08-25T19:35:45",
    "dateReserved": "2021-12-14T00:00:00",
    "dateUpdated": "2024-08-03T17:16:04.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted