CVE-2019-3869
28.03.2019, 14:29
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible_tower | 𝑥 < 3.3.5 |
| redhat | ansible_tower | 3.4.0 ≤ 𝑥 < 3.4.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-214 - Invocation of Process Using Visible Sensitive InformationA process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
- CWE-200 - Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.