CVE-2020-10698: Infoleak
First published: Mon Mar 30 2020(Updated: )
A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible Tower | <3.4.6 | |
| Redhat Ansible Tower | >=3.5.0<3.5.6 | |
| Redhat Ansible Tower | >=3.6.0<3.6.4 | |
| redhat/ansible_tower | <3.6.4 | 3.6.4 |
| redhat/ansible_tower | <3.5.6 | 3.5.6 |
| redhat/ansible_tower | <3.4.6 | 3.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-10698?
CVE-2020-10698 is a vulnerability found in Ansible Tower that allows an attacker to access the stdout of executed jobs.
What is the severity level of CVE-2020-10698?
The severity level of CVE-2020-10698 is low with a severity value of 3.3.
Which version of Ansible Tower is affected by CVE-2020-10698?
Ansible Tower versions up to and including 3.6.4 are affected by CVE-2020-10698.
How can an attacker exploit CVE-2020-10698?
An attacker can exploit CVE-2020-10698 by accessing the stdout of executed jobs in Ansible Tower.
Is there a fix available for CVE-2020-10698?
Yes, the fix for CVE-2020-10698 is available in Ansible Tower version 3.6.4.
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2020-10698
- vendor/redhat
- canonical/redhat ansible tower
- version/redhat ansible tower/3.5.0
- version/redhat ansible tower/3.6.0
- package-manager/redhat