Red Hat Security Advisory

RHSA-2020:3328

Red Hat Ansible Tower 3.7.2-1 - RHEL7 Container

Released 2020-08-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2020-11208 CVE-2020-14337 · GHSA-p8pw-f2qh-mrc2

LOW 29

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.01488 Published 2020-07-31 Fixed CWE-209

TI-2020-11198 CVE-2020-14327 · GHSA-hgxg-vrf8-v76v

LOW 24

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00249 Published 2021-05-27 Fixed CWE-918

TI-2020-11200 CVE-2020-14329 · GHSA-c7r9-mwvj-rr98

LOW 16

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00268 Published 2021-05-27 Fixed CWE-200

TI-2020-11199 CVE-2020-14328 · GHSA-f2f4-jwfq-4q5v

LOW 16

A flaw was found in Ansible Tower in versions before 3.7.2.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0024 Published 2021-05-27 Fixed CWE-918