Security restrictions bypass in Ansible Tower - CVE-2018-16879
Published: December 20, 2018 / Updated: December 26, 2018
Vulnerability identifier: #VU16715
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-16879
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Red Hat Inc.
Affected software:
Ansible Tower
Ansible Tower
Detailed vulnerability description
The vulnerability allows an adjacent attacker to bypass security restrictions.
The vulnerability exists due to security channel is not set properly for AMPQ connection. An adjacent attacker can bypass security restrictions and gain access to potentially sensitive information or cause the service to crash.
How to mitigate CVE-2018-16879
Update to version 3.3.3.