CVE-2019-3869 Information disclosure in Tower
Malicious users can read exposed application credentials from environment variables to gain administrative privileges in Red Hat Tower.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-3869?
CVE-2019-3869 is a high-severity vulnerability in Redhat Ansible Tower, published on 28 Mar 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Which versions are affected by CVE-2019-3869?
It affects 1 product.
Products include Redhat Ansible Tower.
How do I fix CVE-2019-3869?
Upgrade to a fixed version.
Is CVE-2019-3869 being exploited?
There is no known exploitation of CVE-2019-3869 in the wild and no public exploit code.
Other vulnerabilities in Redhat Ansible Tower
Sources
Also known as GHSA-9qmx-gcjw-jrg2.