Red Hat Ansible Tower vulnerabilities

64 CVEs affecting Red Hat Ansible Tower, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4112, published 2022-08-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-17456, published 2018-10-06. Critical severity, CVSS 9.8. EPSS: 97.4% chance of exploitation in the next 30 days. Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git…
CVE-2015-9262, published 2018-08-01. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
CVE-2018-1060, published 2018-06-18. High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days. python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.
CVE-2018-1061, published 2018-06-19. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of…
CVE-2018-1000805, published 2018-10-08. High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days. Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via…
CVE-2018-12910, published 2018-07-05. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
CVE-2018-14682, published 2018-07-28. High severity, CVSS 8.8. EPSS: 3.8% chance of exploitation in the next 30 days. An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.
CVE-2018-14681, published 2018-07-28. High severity, CVSS 8.8. EPSS: 3.8% chance of exploitation in the next 30 days. An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.
CVE-2018-14680, published 2018-07-28. Medium severity, CVSS 6.5. EPSS: 3.7% chance of exploitation in the next 30 days. An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
CVE-2018-14679, published 2018-07-28. Medium severity, CVSS 6.5. EPSS: 3.3% chance of exploitation in the next 30 days. An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service…

Latest

CVE-2021-4112, published 2022-08-25. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user…
CVE-2021-3583, published 2021-09-22. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in…
CVE-2020-14329, published 2021-05-27. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the…
CVE-2020-14328, published 2021-05-27. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal…
CVE-2020-14327, published 2021-05-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the…
CVE-2020-10709, published 2021-05-27. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a…
CVE-2020-10698, published 2021-05-27. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be…
CVE-2020-10697, published 2021-05-27. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a…
CVE-2021-20191, published 2021-05-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage…
CVE-2021-20178, published 2021-05-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw…