High severity · published Mar 28, 2019
CVE-2019-3869
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables
7.2
CVSS
1.3%
EPSS
No
On KEV
Description
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Ansible Tower · Redhat
before 3.3.5; 3.4.0 before 3.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3869
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869
Patch
https://github.com/ansible/awx/pull/3505
More from Ansible Tower
9.8
CVE-2018-16879
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ
9.8
CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing…
9.8
CVE-2015-9262
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow
9.8
CVE-2018-12910
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape