CVE-2019-7664

elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Elfutils Project Redhat

Products

Elfutils Ansible Tower Enterprise Linux and 6 more

CVE-2019-7150

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Elfutils Project and 2 more

Products

Ubuntu Linux Debian Linux Elfutils and 9 more

CVE-2019-7149

elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed

Vendors

Debian Elfutils Project Redhat

Products

Debian Linux Elfutils Ansible Tower and 1 more

CVE-2019-3869

Tower: credentials leaked through environment variables

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Cloudforms Managementengine

CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian Fedoraproject and 2 more

Products

Ghostscript Debian Linux Fedora and 9 more

CVE-2019-3828

Ansible: path traversal in the fetch module

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Engine Openstack

CVE-2019-3820

gnome-shell: partial lock screen bypass

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Gnome Opensuse and 1 more

Products

Ubuntu Linux Gnome-shell Leap and 2 more

CVE-2019-20372

nginx: HTTP request smuggling in configurations with URL redirect used as error_page

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

CVSS 3.1 · 5.3 Medium EPSS 15.0% KEV · Not listed

Vendors

Apple Canonical F5 and 3 more

Products

Xcode Ubuntu Linux Nginx and 5 more

CVE-2019-1559

0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS 3.1 · 5.9 Medium EPSS 17.1% KEV · Not listed

Vendors

Canonical Debian F5 and 10 more

Products

Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 88 more

CVE-2019-19342

Tower: special characters in RabbitMQ passwords causes web socket 500 error

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2019-19341

Tower: intermediate files during Tower backup are world-readable

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every credential stored in Tower. Access to data is the highest threat with this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2019-19340

Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.

CVSS 3.1 · 8.2 High EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Enterprise Linux

CVE-2019-18874

python-psutil: Double free because of refcount mishandling

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Psutil Project Redhat

Products

Psutil Ansible Tower Enterprise Linux and 4 more

CVE-2019-17042

rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 3 more

CVE-2019-17041

rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 3 more

CVE-2019-14905

Ansible: malicious code could craft filename in nxos_file_copy module

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Opensuse Redhat

Products

Fedora Backports Sle Leap and 5 more

CVE-2019-14904

Ansible: vulnerability in solaris_zone module via crafted solaris zone

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Ansible Engine

CVE-2019-14890

Tower: RHSM username and password exposed after license application

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2019-14864

Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Opensuse Redhat

Products

Debian Linux Backports Sle Leap and 6 more