CVE-2020-10698: Infoleak
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the nolog flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
Other sources
Ansible Tower should prevent ws group subscription if not specified in the valid format. Otherwise this would allow normal users intercept stdout from jobs running in other organizations.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10698?
CVE-2020-10698 is a vulnerability found in Ansible Tower that allows an attacker to access the stdout of executed jobs.
What is the severity level of CVE-2020-10698?
The severity level of CVE-2020-10698 is low with a severity value of 3.3.
Which version of Ansible Tower is affected by CVE-2020-10698?
Ansible Tower versions up to and including 3.6.4 are affected by CVE-2020-10698.
How can an attacker exploit CVE-2020-10698?
An attacker can exploit CVE-2020-10698 by accessing the stdout of executed jobs in Ansible Tower.
Is there a fix available for CVE-2020-10698?
Yes, the fix for CVE-2020-10698 is available in Ansible Tower version 3.6.4.