What is CVE-2020-10698?

CVE-2020-10698 is a vulnerability found in Ansible Tower that allows an attacker to access the stdout of executed jobs.

What is the severity level of CVE-2020-10698?

The severity level of CVE-2020-10698 is low with a severity value of 3.3.

Which version of Ansible Tower is affected by CVE-2020-10698?

Ansible Tower versions up to and including 3.6.4 are affected by CVE-2020-10698.

How can an attacker exploit CVE-2020-10698?

An attacker can exploit CVE-2020-10698 by accessing the stdout of executed jobs in Ansible Tower.

Is there a fix available for CVE-2020-10698?

Yes, the fix for CVE-2020-10698 is available in Ansible Tower version 3.6.4.

Vulnerability/
CVE-2020-10698

low

3.3

CWE

200

30/3/2020

27/5/2021

4/8/2024

CVE-2020-10698: Infoleak

First published: Mon Mar 30 2020(Updated: )

A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
Redhat Ansible Tower	<3.4.6
Redhat Ansible Tower	>=3.5.0<3.5.6
Redhat Ansible Tower	>=3.6.0<3.6.4
redhat/ansible_tower	<3.6.4	3.6.4
redhat/ansible_tower	<3.5.6	3.5.6
redhat/ansible_tower	<3.4.6	3.4.6

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=1818924

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2020-10698?
CVE-2020-10698 is a vulnerability found in Ansible Tower that allows an attacker to access the stdout of executed jobs.
What is the severity level of CVE-2020-10698?
The severity level of CVE-2020-10698 is low with a severity value of 3.3.
Which version of Ansible Tower is affected by CVE-2020-10698?
Ansible Tower versions up to and including 3.6.4 are affected by CVE-2020-10698.
How can an attacker exploit CVE-2020-10698?
An attacker can exploit CVE-2020-10698 by accessing the stdout of executed jobs in Ansible Tower.
Is there a fix available for CVE-2020-10698?
Yes, the fix for CVE-2020-10698 is available in Ansible Tower version 3.6.4.

collector/nvd-index
agent/type
agent/softwarecombine
agent/first-publish-date
collector/mitre-cve
source/MITRE
agent/weakness
agent/severity
agent/last-modified-date
agent/references
agent/remedy
agent/author
agent/description
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2020-10698
agent/software-canonical-lookup
agent/event
agent/tags
vendor/redhat
canonical/redhat ansible tower
version/redhat ansible tower/3.5.0
version/redhat ansible tower/3.6.0
package-manager/redhat

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.