Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 130

Export CSV
CVE-2020-10729

Ansible: two random password lookups in same task return same value

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 1 more
CVE-2020-10709

Tower: OAuth2 refresh tokens do not respect the expiration

A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower
CVE-2020-10698

Tower: normal users can intercept stdout from jobs running in other organizations

A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower
CVE-2020-10697

Tower: memcached deployment is insecure on OpenShift

A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. Theoretically, more sophisticated attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out setting values. Confidential and sensitive data stored in memcached should not be pulled, as this information is encrypted. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower
CVE-2020-10691

Ansible: archive traversal vulnerability in ansible-galaxy collection install

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Ansible Tower
CVE-2020-10685

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 3 more
CVE-2020-10684

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 3 more
CVE-2019-9924

bash: BASH_CMD is writable in restricted bash shells

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnu and 3 more
Products
Ubuntu Linux Debian Linux Bash and 9 more
CVE-2019-7665

elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 9 more
CVE-2019-7664

elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Elfutils Project Redhat
Products
Elfutils Ansible Tower Enterprise Linux and 6 more
CVE-2019-7150

elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c

An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 9 more
CVE-2019-7149

elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Elfutils Project Redhat
Products
Debian Linux Elfutils Ansible Tower and 1 more
CVE-2019-3869

Tower: credentials leaked through environment variables

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Managementengine
CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3820

gnome-shell: partial lock screen bypass

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Gnome Opensuse and 1 more
Products
Ubuntu Linux Gnome-shell Leap and 2 more
CVE-2019-20372

nginx: HTTP request smuggling in configurations with URL redirect used as error_page

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

CVSS 3.1 · 5.3 Medium EPSS 15.0% KEV · Not listed
Vendors
Apple Canonical F5 and 3 more
Products
Xcode Ubuntu Linux Nginx and 5 more
CVE-2019-1559

0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS 3.1 · 5.9 Medium EPSS 17.1% KEV · Not listed
Vendors
Canonical Debian F5 and 10 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 88 more
CVE-2019-19342

Tower: special characters in RabbitMQ passwords causes web socket 500 error

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower
CVE-2019-19341

Tower: intermediate files during Tower backup are world-readable

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every credential stored in Tower. Access to data is the highest threat with this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower