RHSA-2021:0780: Important: Red Hat Ansible Tower 3.8.2-1 - Container security and bug fix update

Published Mar 9, 2021
·
Updated

Security Fix(es): Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253 Upgraded to a more recent version of Django to address CVE-2021-3281. Upgraded to a more recent version of autobahn to address CVE-2020-35678. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): Upgraded to the latest oVirt inventory plugin to resolve a number of inventory syncing issues that can occur on RHEL7. Upgraded to the latest theforeman.foreman inventory plugin to resolve a few bugs and performance regressions. Fixed several issues related to how Tower rotates its log files. Fixed a bug which can prevent Tower from installing on RHEL8 with certain non-enUS.UTF-8 locales. Fixed a bug which can cause unanticipated delays in certain playbook output. Fixed a bug which can cause job runs to fail for playbooks that print certain types of raw binary data. Fixed a bug which can cause unnecessary records in the Activity Stream when Automation Analytics data is collected. Fixed a bug which can cause Tower PostgreSQL backups to fail when a non-default PostgreSQL username is specified. Fixed a bug which can intermittently cause access to encrypted Tower settings to fail, resulting in failed job launches. Fixed a bug which can cause certain long-running jobs running on isolated nodes to unexpectedly fail.

Affected Software

1 affected component
Red Hat Ansible Tower

Remediation

Event History

Mar 9, 2021
Advisory Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of RHSA-2021:0780?

The severity of RHSA-2021:0780 is classified as important.

2

What vulnerabilities are addressed in RHSA-2021:0780?

RHSA-2021:0780 addresses CVE-2021-20253 and CVE-2021-3281.

3

How do I fix RHSA-2021:0780?

To fix RHSA-2021:0780, update to the latest package recommended in the advisory.

4

Who is affected by RHSA-2021:0780?

RHSA-2021:0780 affects users of affected Red Hat software including those using older versions of Django.

5

What could happen if I don't address RHSA-2021:0780?

If RHSA-2021:0780 is not addressed, attackers may exploit the vulnerabilities to escalate privileges.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203