CVE-2019-3869: Infoleak
Published Mar 28, 2019
·Updated
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Affected Software
2 affected components
redhat Ansible Tower<3.3.5
redhat Ansible Tower>=3.4.0<3.4.3
Remediation
Patch Available
Patch Available
Event History
Mar 28, 2019
CVE Published
via MITRE·01:04 PM
Data Sourced
via MITRE·01:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2019-3869?
CVE-2019-3869 is a vulnerability in Redhat Ansible Tower where application credentials are exposed to playbook job runs via environment variables.
2
What is the severity of CVE-2019-3869?
CVE-2019-3869 has a severity rating of 7.2 (High).
3
How does CVE-2019-3869 affect Redhat Ansible Tower?
CVE-2019-3869 affects Redhat Ansible Tower versions up to 3.3.5 and versions between 3.4.0 and 3.4.3.
4
How can a malicious user exploit CVE-2019-3869?
A malicious user with the ability to write playbooks could exploit CVE-2019-3869 to gain administrative privileges.
5
Is there a fix or patch available for CVE-2019-3869?
Yes, the fix for CVE-2019-3869 is included in Tower version 3.4.3.