CVE-2016-7070 Privilege escalation in Ansible Tower

High 8.0 Published 11 Sep 2018 Updated 6 Aug 2024

An attacker can gain admin access to the PostgreSQL database due to incorrect trust configuration in Ansible Tower deployments.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-7070?

CVE-2016-7070 is a high-severity vulnerability in Redhat Ansible Tower, published on 11 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database.

Weakness: CWE-264, CWE-266

Which versions are affected by CVE-2016-7070?

It affects 1 product.

Products include Redhat Ansible Tower.

How do I fix CVE-2016-7070?

No fix has been published for CVE-2016-7070 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-7070 being exploited?

There is no known exploitation of CVE-2016-7070 in the wild and no public exploit code.

All Redhat Ansible Tower vulnerabilities

Sources

Also known as GHSA-674g-jv56-24mf.