Read the docs
Red Hat Security Advisory

RHSA-2019:0796

CloudForms 4.7.3 security, bug fix and enhancement update

Released 2019-04-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 3 records

TI-2019-03828 CVE-2019-5418 · GHSA-86g5-2wh3-gc9j

Path traversal in Rails https://github.com/rails/rails

Priority CRITICAL 90KEV

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesyste…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.98507 Published 2019-03-27 Fixed in 5.2.2.1, 4.2.11.1 +2 CWE-22
TI-2019-03829 CVE-2019-5419 · GHSA-m63j-wh5w-c252

Uncontrolled resource consumption in Rails https://github.com/rails/rails

Priority MEDIUM 44

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unre…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0844 Published 2019-03-27 Fixed in 4.2.11.1, 5.2.2.1 +3 CWE-400
TI-2019-02879 CVE-2019-3869 · GHSA-9qmx-gcjw-jrg2

Information disclosure in Red Hat Tower

Priority LOW 34

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01266 Published 2019-03-28 Fixed CWE-214