CVE-2019-3869 - Tower: credentials leaked through environment variables

Back Back to CVE browser

HIGH

Tower: credentials leaked through environment variables

Published Mar 28, 2019

7.2

HIGH

CVSS 3.1

EPSS 1.27%

Description

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

Affected products

Vendor Red Hat Product Tower Default
n/a
- Version
  3.3.5
  Status
  affected
  Constraints
  -
- Version
  3.4.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Red Hat

Tower

n/a

Version	Status	Constraints
3.3.5	affected	-
3.4.3	affected	-

CloudForms Management Engine 5.10

ansible-tower-0:3.4.3-1.el7at

Fixed · RHSA-2019:0796
CloudForms Management Engine 5.10

cfme-0:5.10.3.3-1.el7cf

Fixed · RHSA-2019:0796
CloudForms Management Engine 5.10

cfme-amazon-smartstate-0:5.10.3.3-1.el7cf

Fixed · RHSA-2019:0796
CloudForms Management Engine 5.10

cfme-appliance-0:5.10.3.3-1.el7cf

Fixed · RHSA-2019:0796
CloudForms Management Engine 5.10

cfme-gemset-0:5.10.3.3-1.el7cf

Fixed · RHSA-2019:0796
Red Hat Ansible Tower 3.3 for RHEL 7

ansible-tower-33/ansible-tower:3.3.5-3

Fixed · RHBA-2019:0884
Red Hat Ansible Tower 3.4 for RHEL 7

ansible-tower-34/ansible-tower-memcached:1.4.15-18

Fixed · RHBA-2019:0885
Red Hat Ansible Tower 3.4 for RHEL 7

ansible-tower-34/ansible-tower-messaging:3.7.4-10

Fixed · RHBA-2019:0885
Red Hat Ansible Tower 3.4 for RHEL 7

ansible-tower-34/ansible-tower:3.4.3-4

Fixed · RHBA-2019:0885

Product	Package	State	Advisory
CloudForms Management Engine 5.10	ansible-tower-0:3.4.3-1.el7at	Fixed	RHSA-2019:0796
CloudForms Management Engine 5.10	cfme-0:5.10.3.3-1.el7cf	Fixed	RHSA-2019:0796
CloudForms Management Engine 5.10	cfme-amazon-smartstate-0:5.10.3.3-1.el7cf	Fixed	RHSA-2019:0796
CloudForms Management Engine 5.10	cfme-appliance-0:5.10.3.3-1.el7cf	Fixed	RHSA-2019:0796
CloudForms Management Engine 5.10	cfme-gemset-0:5.10.3.3-1.el7cf	Fixed	RHSA-2019:0796
Red Hat Ansible Tower 3.3 for RHEL 7	ansible-tower-33/ansible-tower:3.3.5-3	Fixed	RHBA-2019:0884
Red Hat Ansible Tower 3.4 for RHEL 7	ansible-tower-34/ansible-tower-memcached:1.4.15-18	Fixed	RHBA-2019:0885
Red Hat Ansible Tower 3.4 for RHEL 7	ansible-tower-34/ansible-tower-messaging:3.7.4-10	Fixed	RHBA-2019:0885
Red Hat Ansible Tower 3.4 for RHEL 7	ansible-tower-34/ansible-tower:3.4.3-4	Fixed	RHBA-2019:0885

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-214

References (6)

https://access.redhat.com/security/cve/CVE-2019-3869
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1688508
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869
x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
https://github.com/ansible/awx/pull/3505
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3869
https://www.cve.org/CVERecord?id=CVE-2019-3869

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-3869		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1688508		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3869		x_refsource_CONFIRMIssue TrackingPatchVendor Advisory
https://github.com/ansible/awx/pull/3505		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-3869
https://www.cve.org/CVERecord?id=CVE-2019-3869