Skip to content
fr Sign in
7.2 High

CVE-2019-3869 When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via…

Description

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

Affected products and versions

Product Affected versions Fixed in
Tower 3.4.3 No fix stated
Tower 3.3.5 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Tower

The 3 CVEs of Tower →
CVE-2019-19342 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested… 5.3 Medium CVE-2019-19340 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager… 8.2 High
Track this CVE