Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

64 records

Vendor: Red Hat Component: Ansible Tower Clear all filters
TI-2021-02532 CVE-2021-3583 · GHSA-2pfh-q76x-gwvm

Improper input validation in ansible

Priority LOW 33

A flaw was found in Ansible, where a user's controller is vulnerable to template injection.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00897 Published 2021-09-22 Partial fix · 2.9.23rc1, 2.10.11rc1 +1 CWE-20
TI-2020-11200 CVE-2020-14329 · GHSA-c7r9-mwvj-rr98

Information disclosure in Tower

Priority LOW 16

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00268 Published 2021-05-27 Fixed CWE-200
TI-2020-11199 CVE-2020-14328 · GHSA-f2f4-jwfq-4q5v

Server-side request forgery in Tower

Priority LOW 16

A flaw was found in Ansible Tower in versions before 3.7.2.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0024 Published 2021-05-27 Fixed CWE-918
TI-2020-11198 CVE-2020-14327 · GHSA-hgxg-vrf8-v76v

Server-side request forgery in Tower

Priority LOW 24

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00249 Published 2021-05-27 Fixed CWE-918
TI-2020-08608 CVE-2020-10709 · GHSA-g252-frw3-5wcr

Improper authentication in Tower

Priority LOW 31

A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00272 Published 2021-05-27 No fix listed CWE-287
TI-2020-08599 CVE-2020-10698 · GHSA-j574-xrvq-v9wf

Information disclosure in Tower

Priority LOW 16

A flaw was found in Ansible Tower when running jobs.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00271 Published 2021-05-27 No fix listed CWE-200
TI-2020-08598 CVE-2020-10697 · GHSA-rhg6-3qw6-38pp

Missing authorization in Tower

Priority LOW 20

A flaw was found in Ansible Tower when running Openshift.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00239 Published 2021-05-27 No fix listed CWE-862
TI-2021-03490 CVE-2021-20191 · GHSA-8f4m-hccc-8qph

Sensitive information in log files in ansible

Priority LOW 25

A flaw was found in ansible.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00347 Published 2021-05-26 Partial fix · 2.9.18rc1, 2.8.19rc1 +1 CWE-532
TI-2021-03478 CVE-2021-20178 · GHSA-wv5p-gmmv-wh9v

Sensitive information in log files in Ansible

Priority LOW 25

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00337 Published 2021-05-26 Partial fix · 2.9.18 CWE-532
TI-2021-03523 CVE-2021-20228 · GHSA-5rrg-rr89-x9mv

Information disclosure in ansible

Priority LOW 37

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02043 Published 2021-04-29 Partial fix · 2.10.6rc1, 2.9.18rc1 +1 CWE-200
TI-2021-02411 CVE-2021-3447 · GHSA-29hx-hv84-8wcq

Sensitive information in log files in ansible

Priority LOW 25

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in ve…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00333 Published 2021-04-01 Partial fix CWE-532
TI-2021-03545 CVE-2021-20253 · GHSA-rr45-4xhx-rxc8

A flaw was found in ansible-tower.

Priority LOW 30

A flaw was found in ansible-tower.

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00411 Published 2021-03-09 Partial fix CWE-552
TI-2020-11233 CVE-2020-14365 · GHSA-m429-fhmv-c6q2

Improper signature verification in ansible

Priority LOW 31

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00233 Published 2020-09-23 Partial fix · 2.8.15, 2.9.13 CWE-347
TI-2020-08677 CVE-2020-10782 · GHSA-8g82-ff8g-pqf2

Information disclosure in Red Hat Ansible Tower

Priority LOW 29

An exposure of sensitive information flaw was found in Ansible version 3.7.0.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00294 Published 2020-06-18 Fixed CWE-200
TI-2020-08642 CVE-2020-10744 · GHSA-vp9j-rghq-8jhh

Race condition in Red Hat ansible

Priority LOW 22

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive.

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.00255 Published 2020-05-15 Partial fix · 2.10.0rc1, 2.9.12 CWE-377
TI-2020-01689 CVE-2020-1746 · GHSA-j2h6-73x8-22c4

Information disclosure in Red Hat ansible

Priority LOW 23

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3…

CVSS 3.1MEDIUM 5.0 Local Low privileges User interaction EPSS 0.0039 Published 2020-05-12 Partial fix · 2.8.11, 2.9.7 +1 CWE-200
TI-2020-08588 CVE-2020-10685 · GHSA-77g3-3j5w-64w4

Exposure of resource to wrong sphere in Red Hat Ansible

Priority LOW 25

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 whe…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00361 Published 2020-05-11 Partial fix · 2.7.17, 2.8.11 +1 CWE-459
TI-2020-08594 CVE-2020-10691 · GHSA-3c67-gc48-983w

Path traversal in Red Hat Ansible

Priority LOW 23

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install.

CVSS 3.1MEDIUM 5.2 Local Low privileges No interaction EPSS 0.00303 Published 2020-04-30 Fixed in 2.9.7 CWE-22
TI-2019-11108 CVE-2019-14905 · GHSA-frxj-5j27-f8rf

Improper input validation in Red Hat Ansible

Priority LOW 26

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on…

CVSS 3.1MEDIUM 5.6 Local High privileges No interaction EPSS 0.00713 Published 2020-03-31 Partial fix · 2.9.3, 2.8.8 +1 CWE-20
TI-2020-08587 CVE-2020-10684 · GHSA-p62g-jhg6-v3rq

Race condition in Red Hat Ansible

Priority LOW 34

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled,…

CVSS 3.1HIGH 7.9 Local Low privileges User interaction EPSS 0.00331 Published 2020-03-24 Partial fix · 2.7.17, 2.8.11 +1 CWE-362
TI-2020-01684 CVE-2020-1740 · GHSA-vcg8-98q8-g7mj

Information disclosure in Red Hat ansible

Priority LOW 22

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.0036 Published 2020-03-16 Partial fix · 2.7.17, 2.8.11 +1 CWE-377
TI-2020-01679 CVE-2020-1735 · GHSA-gfr2-qpxh-qj9m

Path traversal in Red Hat ansible

Priority LOW 22

A flaw was found in the Ansible Engine when the fetch module is used.

CVSS 3.1MEDIUM 4.6 Local High privileges No interaction EPSS 0.00468 Published 2020-03-16 Partial fix · 2.7.18, 2.8.12 +1 CWE-22
Load more