AT
Product
Ansible Tower
64
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 22Medium 32Low 6
Watch
Add Ansible Tower to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-16879 | 9.8 | Jan 3 | Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ Affected: before 3.3.3 |
| CVE-2018-17456 | 9.8 | Oct 6 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing… Affected: 3.3 |
| CVE-2015-9262 | 9.8 | Aug 1 | _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow Affected: 3.3 |
| CVE-2018-12910 | 9.8 | Jul 5 | The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname Affected: 3.3 |
| CVE-2021-4112 | 8.8 | Aug 25 | A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape Affected: 3.0 |
| CVE-2018-1000805 | 8.8 | Oct 8 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE Affected: 3.3 |
| CVE-2018-10884 | 8.8 | Aug 22 | Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py Affected: 3.1.0 through 3.1.8; 3.2.0 through 3.2.6 |
| CVE-2018-14682 | 8.8 | Jul 28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha Affected: 3.3 |
| CVE-2018-14681 | 8.8 | Jul 28 | An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha Affected: 3.3 |
| CVE-2018-1104 | 8.8 | May 2 | Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server Affected: through 3.2.3 |
| CVE-2019-14890 | 8.4 | Nov 26 | A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain… Affected: 3.6.0 |
| CVE-2019-19340 | 8.2 | Dec 19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes… Affected: 3.5.0 before 3.5.3; 3.6.0 before 3.6.2 |
| CVE-2016-7070 | 8.0 | Sep 11 | A privilege escalation flaw was found in the Ansible Tower Affected: before 3.0.3 |
| CVE-2020-1737 | 7.8 | Mar 9 | A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not… Affected: through 3.3.4; 3.4.0 through 3.4.5; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 |
| CVE-2018-16837 | 7.8 | Oct 23 | Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen Affected: 3.3.0 |
| CVE-2021-20228 | 7.5 | Apr 29 | A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the… Affected: 3.0 |
| CVE-2018-1061 | 7.5 | Jun 19 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method Affected: 3.3 |
| CVE-2018-1060 | 7.5 | Jun 18 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method Affected: 3.3 |
| CVE-2020-1734 | 7.4 | Mar 3 | A flaw was found in the pipe lookup plugin of ansible Affected: through 3.3.4; 3.4.5; 3.5.5; 3.6.3 |
| CVE-2019-3869 | 7.2 | Mar 28 | When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables Affected: before 3.3.5; 3.4.0 before 3.4.3 |
| CVE-2017-12148 | 7.2 | Jul 27 | A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories Affected: before 3.1.5; before 3.2.0 |
| CVE-2018-1101 | 7.2 | May 2 | Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation Affected: before 3.2.4 |
| CVE-2021-3583 | 7.1 | Sep 22 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection Affected: before 3.7.0 |
| CVE-2020-10709 | 7.1 | May 27 | A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application Affected: before 3.5.6; 3.6.0 before 3.6.4 |
| CVE-2020-14365 | 7.1 | Sep 23 | A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module Affected: 3.6.0 through 3.6.5; 3.7.0 through 3.7.2; 3.0 |
| CVE-2020-10684 | 7.1 | Mar 24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting… Affected: through 3.3.5; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 |
| CVE-2021-20253 | 6.7 | Mar 9 | A flaw was found in ansible-tower Affected: before 3.6.7; 3.7.0 before 3.7.5; 3.8.0 before 3.8.2 |
| CVE-2020-10782 | 6.5 | Jun 18 | An exposure of sensitive information flaw was found in Ansible version 3.7.0 Affected: 3.7.0 |
| CVE-2019-14864 | 6.5 | Jan 2 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk… Affected: 3.0 |
| CVE-2017-7528 | 6.5 | Aug 22 | Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection Affected: All versions, or not specified |
| CVE-2018-14680 | 6.5 | Jul 28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha Affected: 3.3 |
| CVE-2018-14679 | 6.5 | Jul 28 | An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha Affected: 3.3 |
| CVE-2018-13988 | 6.5 | Jul 25 | Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite Affected: 3.3.0 |
| CVE-2018-10768 | 6.5 | May 6 | There is a NULL pointer dereference in the AnnotPath::getCoordsLength function in Annot.h in an Ubuntu package for Poppler 0.24.5 Affected: 3.3 |
| CVE-2018-10767 | 6.5 | May 6 | There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject… Affected: 3.3 |
| CVE-2018-10733 | 6.5 | May 4 | There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0 Affected: 3.3 |
| CVE-2020-14337 | 5.8 | Jul 31 | A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes Affected: 3.0.0 |
| CVE-2019-14905 | 5.6 | Mar 31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used… Affected: 3.0.0 |
| CVE-2020-14327 | 5.5 | May 27 | A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2 Affected: before 3.6.5; 3.7.0 before 3.7.2 |
| CVE-2021-20191 | 5.5 | May 26 | A flaw was found in ansible Affected: 3.0 |
| CVE-2021-20178 | 5.5 | May 26 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the… Affected: 3.0 |
| CVE-2021-3447 | 5.5 | Apr 1 | A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made… Affected: before 3.8.2 |
| CVE-2020-10685 | 5.5 | May 11 | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and… Affected: through 3.4.5; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 |
| CVE-2020-1753 | 5.5 | Mar 16 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7,… Affected: through 3.3.4; 3.4.0 through 3.4.5; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 |
| CVE-2019-19341 | 5.5 | Dec 19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable Affected: 3.6.0 before 3.6.2 |
| CVE-2019-14858 | 5.5 | Oct 14 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5 Affected: 3.0 through 3.5.0 |
| CVE-2019-3838 | 5.5 | Mar 25 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27 Affected: 3.3 |
| CVE-2019-3835 | 5.5 | Mar 25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27 Affected: 3.3 |
| CVE-2017-18267 | 5.5 | May 10 | The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via a crafted PDF file,… Affected: 3.3 |
| CVE-2019-19342 | 5.3 | Dec 19 | A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character Affected: 3.5.0 before 3.5.4; 3.6.0 before 3.6.2 |