Red Hat Tower vulnerabilities

3 vulnerabilities

Known vulnerabilities in Red Hat Tower, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.2CVE-2019-19340red hattower+2
EPSS score
1.53%
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.5.3CVE-2019-19342red hattower+1
EPSS score
1.11%
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.7.2CVE-2019-3869red hattower+1
EPSS score
1.27%
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.