Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2019-19342 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested…

Description

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

Produits et versions touchés

Produit Versions touchées Corrigé en
Tower Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Tower

Les 3 CVE de Tower →
CVE-2019-19340 A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager… 8.2 Élevée CVE-2019-3869 When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via… 7.2 Élevée
Suivre cette CVE