Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 130

Export CSV
CVE-2019-19340

Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.

CVSS 3.1 · 8.2 High EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Enterprise Linux
CVE-2019-18874

python-psutil: Double free because of refcount mishandling

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Psutil Project Redhat
Products
Psutil Ansible Tower Enterprise Linux and 4 more
CVE-2019-17042

rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 3 more
CVE-2019-17041

rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 3 more
CVE-2019-14905

Ansible: malicious code could craft filename in nxos_file_copy module

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Backports Sle Leap and 5 more
CVE-2019-14890

Tower: RHSM username and password exposed after license application

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower
CVE-2019-14864

Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Backports Sle Leap and 6 more
CVE-2019-14858

ansible: sub parameters marked as no_log are not masked in certain failure scenarios

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Ansible Tower Openstack
CVE-2019-13734

sqlite: fts3: improve shadow table corruption detection

Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 17 more
CVE-2019-11745

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVSS 3.1 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 26 more
CVE-2019-11236

python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

CVSS 3.0 · 6.1 Medium EPSS 2.1% KEV · Not listed
Vendors
Python Redhat
Products
Urllib3 Ansible Tower Enterprise Linux and 1 more
CVE-2018-5819

LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp

An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Libraw Redhat
Products
Debian Linux Libraw Ansible Tower and 1 more
CVE-2018-5818

LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp

An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Libraw Redhat
Products
Debian Linux Libraw Ansible Tower and 1 more
CVE-2018-20217

krb5: Reachable assertion in the KDC using S4U2Self requests

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos Ansible Tower and 1 more
CVE-2018-1122

procps: Local privilege escalation in top

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

CVSS 3.0 · 7.3 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Procps-ng Project and 1 more
Products
Ubuntu Linux Debian Linux Procps-ng and 6 more
CVE-2018-1104

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

CVSS 3.0 · 8.8 High EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-1101

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

CVSS 3.0 · 7.2 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Ansible Tower Cloudforms Cloudforms Managementengine
CVE-2018-18521

elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c

Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.

CVSS 3.1 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 6 more
CVE-2018-18520

elfutils: eu-size cannot handle recursive ar files

An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 6 more
CVE-2018-18310

elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl

An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Elfutils Project and 2 more
Products
Ubuntu Linux Debian Linux Elfutils and 6 more