rhsa-2021_0780
Vulnerability from csaf_redhat
Published
2021-03-09 16:01
Modified
2024-11-05 23:22
Summary
Red Hat Security Advisory: Red Hat Ansible Tower 3.8.2-1 - Container security and bug fix update

Notes

Topic
Red Hat Ansible Tower 3.8.2-1 - Container Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Security Fix(es): * Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253 * Upgraded to a more recent version of Django to address CVE-2021-3281. * Upgraded to a more recent version of autobahn to address CVE-2020-35678. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Upgraded to the latest oVirt inventory plugin to resolve a number of inventory syncing issues that can occur on RHEL7. * Upgraded to the latest theforeman.foreman inventory plugin to resolve a few bugs and performance regressions. * Fixed several issues related to how Tower rotates its log files. * Fixed a bug which can prevent Tower from installing on RHEL8 with certain non-en_US.UTF-8 locales. * Fixed a bug which can cause unanticipated delays in certain playbook output. * Fixed a bug which can cause job runs to fail for playbooks that print certain types of raw binary data. * Fixed a bug which can cause unnecessary records in the Activity Stream when Automation Analytics data is collected. * Fixed a bug which can cause Tower PostgreSQL backups to fail when a non-default PostgreSQL username is specified. * Fixed a bug which can intermittently cause access to encrypted Tower settings to fail, resulting in failed job launches. * Fixed a bug which can cause certain long-running jobs running on isolated nodes to unexpectedly fail.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Ansible Tower 3.8.2-1 - Container\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Security Fix(es):\n\n* Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253\n* Upgraded to a more recent version of Django to address CVE-2021-3281.\n* Upgraded to a more recent version of autobahn to address CVE-2020-35678.\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Upgraded to the latest oVirt inventory plugin to resolve a number of inventory syncing issues that can occur on RHEL7.\n* Upgraded to the latest theforeman.foreman inventory plugin to resolve a few bugs and performance regressions.\n* Fixed several issues related to how Tower rotates its log files.\n* Fixed a bug which can prevent Tower from installing on RHEL8 with certain non-en_US.UTF-8 locales.\n* Fixed a bug which can cause unanticipated delays in certain playbook output.\n* Fixed a bug which can cause job runs to fail for playbooks that print certain types of raw binary data.\n* Fixed a bug which can cause unnecessary records in the Activity Stream when Automation Analytics data is collected.\n* Fixed a bug which can cause Tower PostgreSQL backups to fail when a non-default PostgreSQL username is specified.\n* Fixed a bug which can intermittently cause access to encrypted Tower settings to fail, resulting in failed job launches.\n* Fixed a bug which can cause certain long-running jobs running on isolated nodes to unexpectedly fail.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:0780",
        "url": "https://access.redhat.com/errata/RHSA-2021:0780"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1911314",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911314"
      },
      {
        "category": "external",
        "summary": "1919969",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919969"
      },
      {
        "category": "external",
        "summary": "1928847",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928847"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0780.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Tower 3.8.2-1 - Container security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-05T23:22:12+00:00",
      "generator": {
        "date": "2024-11-05T23:22:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2021:0780",
      "initial_release_date": "2021-03-09T16:01:49+00:00",
      "revision_history": [
        {
          "date": "2021-03-09T16:01:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-03-09T16:01:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T23:22:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Tower 3.8 for RHEL 7",
                "product": {
                  "name": "Red Hat Ansible Tower 3.8 for RHEL 7",
                  "product_id": "7Server-Ansible-Tower-3.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:3.8::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
                "product": {
                  "name": "ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
                  "product_id": "ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-38/ansible-runner-rhel7\u0026tag=1.4.7-1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64",
                "product": {
                  "name": "ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64",
                  "product_id": "ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-38/ansible-tower-rhel7\u0026tag=3.8.2-1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64 as a component of Red Hat Ansible Tower 3.8 for RHEL 7",
          "product_id": "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64"
        },
        "product_reference": "ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
        "relates_to_product_reference": "7Server-Ansible-Tower-3.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64 as a component of Red Hat Ansible Tower 3.8 for RHEL 7",
          "product_id": "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
        },
        "product_reference": "ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64",
        "relates_to_product_reference": "7Server-Ansible-Tower-3.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-35678",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "discovery_date": "2020-12-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1911314"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in python-autobahn, where it allows redirect header injection. The highest threat from this vulnerability is to confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-autobahn: allows redirect header injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-autobahn package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-35678"
        },
        {
          "category": "external",
          "summary": "RHBZ#1911314",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911314"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-35678",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-35678"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35678",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35678"
        }
      ],
      "release_date": "2020-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-03-09T16:01:49+00:00",
          "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0780"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-autobahn: allows redirect header injection"
    },
    {
      "cve": "CVE-2021-3281",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2021-01-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1919969"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in django where the`django.utils.archive.extract()` function, used by `startapp --template` and `startproject --template`, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "django: Potential directory-traversal via archive.extract()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The following products ship affected version of python-django, however the vulnerable function archive.extract() is currently not used in any part of the product and hence this issue has been rated as having a security impact of Low:\n* Red Hat Gluster Storage 3\n* Red Hat Update Infrastructure 3\n\nBecause the flaw\u0027s impact is lower and Red Hat OpenStack Platform 13 will be retiring soon, no update will be provided at this time for the RHOSP13 python-django package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3281"
        },
        {
          "category": "external",
          "summary": "RHBZ#1919969",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919969"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3281",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3281"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3281",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3281"
        }
      ],
      "release_date": "2021-02-01T10:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-03-09T16:01:49+00:00",
          "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0780"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "django: Potential directory-traversal via archive.extract()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Matei Mal Badanoiu"
          ],
          "organization": "Deloitte Romania"
        }
      ],
      "cve": "CVE-2021-20253",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "discovery_date": "2021-02-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1928847"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible-tower: Privilege escalation via job isolation escape",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
          "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-20253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1928847",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928847"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-20253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-20253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-20253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20253"
        }
      ],
      "release_date": "2021-03-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-03-09T16:01:49+00:00",
          "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:0780"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
          "product_ids": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-runner-rhel7@sha256:6208e426e90515de013194566833baad60f41df1052f25f45e55e8c0341ec62a_amd64",
            "7Server-Ansible-Tower-3.8:ansible-tower-38/ansible-tower-rhel7@sha256:75e3ded9918cd3485fdd0e5b78006b08d9453eec304dfc5c635e5638bb77b0de_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ansible-tower: Privilege escalation via job isolation escape"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.