Skip to content
fr Sign in
5.3 Medium

CVE-2019-19342 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested…

Description

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

Affected products and versions

Product Affected versions Fixed in
Tower Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tower

The 3 CVEs of Tower →
CVE-2019-19340 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager… 8.2 High CVE-2019-3869 When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via… 7.2 High
Track this CVE