rhba-2021_3472
Vulnerability from csaf_redhat
Published
2021-09-08 19:22
Modified
2024-11-05 15:59
Summary
Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container

Notes

Topic
Red Hat Ansible Tower 3.8.4-1 - Container
Details
* Running inventories of ~60k hosts no longer takes a very long time for events to show up * Removed ``artifact_data`` from data sent to analytics as part of ``playbook_on_stats``, since ``artifact_data`` can contain PII or sensitive data * Regular users are no longer experiencing longer load times than a superuser when clicking to edit a job template * Updated password validation support to allow modifying password complexity requirements using some Django configurations * Fixed AWS inventory tags filtering to support the ``OR`` condition * Updated Ansible version to 2.9.25 * Updated Django version to 2.2.20 * Fixed Tower's NGINX Instance vulnerability (CVE-2021-23017)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Ansible Tower 3.8.4-1 - Container",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "* Running inventories of ~60k hosts no longer takes a very long time for events to show up\n* Removed ``artifact_data`` from data sent to analytics as part of ``playbook_on_stats``, since ``artifact_data`` can contain PII or sensitive data\n* Regular users are no longer experiencing longer load times than a superuser when clicking to edit a job template\n* Updated password validation support to allow modifying password complexity requirements using some Django configurations\n* Fixed AWS inventory tags filtering to support the ``OR`` condition\n* Updated Ansible version to 2.9.25\n* Updated Django version to 2.2.20\n* Fixed Tower\u0027s NGINX Instance vulnerability (CVE-2021-23017)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2021:3472",
        "url": "https://access.redhat.com/errata/RHBA-2021:3472"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_3472.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.8.4-1 - Container",
    "tracking": {
      "current_release_date": "2024-11-05T15:59:52+00:00",
      "generator": {
        "date": "2024-11-05T15:59:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHBA-2021:3472",
      "initial_release_date": "2021-09-08T19:22:08+00:00",
      "revision_history": [
        {
          "date": "2021-09-08T19:22:08+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-09-08T19:22:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T15:59:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Tower 3.8 for RHEL 7",
                "product": {
                  "name": "Red Hat Ansible Tower 3.8 for RHEL 7",
                  "product_id": "7Server-Ansible-Tower-3.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:3.8::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64",
                "product": {
                  "name": "ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64",
                  "product_id": "ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-38/ansible-tower-rhel7\u0026tag=3.8.4-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64 as a component of Red Hat Ansible Tower 3.8 for RHEL 7",
          "product_id": "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
        },
        "product_reference": "ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64",
        "relates_to_product_reference": "7Server-Ansible-Tower-3.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-23017",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2021-05-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1963121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-23017"
        },
        {
          "category": "external",
          "summary": "RHBZ#1963121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1963121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-23017",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-23017"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23017"
        }
      ],
      "release_date": "2021-05-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-08T19:22:08+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2021:3472"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name"
    },
    {
      "cve": "CVE-2021-31535",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2021-05-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1961822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in some cases, also bypass, authenticate (via injection of control characters), or potentially execute arbitrary code with permissions of the application compiled with libX11. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libX11: missing request length checks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Xorg server does not run with root  privileges in Red Hat Enterprise Linux 8 therefore this flaw has been rated as having moderate impact for Red Hat Enterprise linux 8. RHEL 9 is not vulnerable but is affected, because it is not default configured to run as root.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-31535"
        },
        {
          "category": "external",
          "summary": "RHBZ#1961822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1961822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-31535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-31535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-31535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31535"
        },
        {
          "category": "external",
          "summary": "https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/",
          "url": "https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/"
        },
        {
          "category": "external",
          "summary": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt",
          "url": "https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt"
        }
      ],
      "release_date": "2021-05-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-08T19:22:08+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2021:3472"
        },
        {
          "category": "workaround",
          "details": "xterm should not be used to display less trusted data, e.g. from SSH connections to less trusted remote machines.\nTo avoid attacks via .Xdefaults on kiosk type machines, where graphical user has no permission to execute arbitrary operating system commands or sometimes not even to send hardware keyboard keystrokes, the .Xdefaults must not be modifiable by the user.",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libX11: missing request length checks"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Tom Lane"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32027",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2021-05-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1956876"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgresql: Buffer overrun from integer overflow in array subscripting calculations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Writing arbitrary bytes to a wide area of server memory can provide a powerful primitive that could ultimately lead to remote code execution. For this reason this flaw has been rated as having a security impact of Important. The versions of `postgresql` as shipped with Red Hat Enterprise Linux 7, 8 and Red Hat Software Collections are all affected by this flaw. A future update may address this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32027"
        },
        {
          "category": "external",
          "summary": "RHBZ#1956876",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956876"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32027",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32027"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32027",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32027"
        },
        {
          "category": "external",
          "summary": "https://www.postgresql.org/support/security/CVE-2021-32027/",
          "url": "https://www.postgresql.org/support/security/CVE-2021-32027/"
        }
      ],
      "release_date": "2021-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-08T19:22:08+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2021:3472"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgresql: Buffer overrun from integer overflow in array subscripting calculations"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Andres Freund"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2021-32028",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-05-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1956877"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-32028"
        },
        {
          "category": "external",
          "summary": "RHBZ#1956877",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956877"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-32028",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-32028"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-32028",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32028"
        },
        {
          "category": "external",
          "summary": "https://www.postgresql.org/support/security/CVE-2021-32028/",
          "url": "https://www.postgresql.org/support/security/CVE-2021-32028/"
        }
      ],
      "release_date": "2021-05-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-08T19:22:08+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2021:3472"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:5bde31ed06a473f6326390136b04b56e5cab05aa457b9592b1977167d0a45a02_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.