A flaw was found in openshift-ansible. When this occurs, there is a race condition on the managed machine. The Ansible log file is readable to all users during stack update and creation. A cross-site request forgery vulnerability in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6. There are NO warranties, implied or otherwise, with regard to this information or its use. This flaw allows an attacker to obtain a refresh token that does not expire. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2. lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/. Fields managing sensitive data should be set as such by no_log feature. Confidential and sensitive data stored in memcached should not be pulled, as this information is encrypted. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. These parameters were not protected by the no_log feature. By taking advantage of unintended variable substitution the content of any variable may be disclosed. A Least Privilege Violation vulnerability in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. Contact Us | An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file. An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. A flaw was found in the Ansible Engine when the fetch module is used. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. This flaw does not affect Ansible modules, as those are executed in a separate process. Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database). This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4. This issue affects directly data confidentiality. The highest threat from this vulnerability is to integrity and system availability. An attacker can insert python into the vault to trigger this vulnerability. A specially crafted vault can execute arbitrary python commands resulting in command execution. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. Known limitations & technical details, User agreement, disclaimer and privacy statement. The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files. The system will be vulnerable when the system is not running. A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. The highest threat from this vulnerability is to confidentiality. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/
/cmdline'. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. security serverless If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. The highest threat from this vulnerability is to data confidentiality. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power. Thus the previous password would still be active when it should have been changed. Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism. This issue affects mainly the service availability. A flaw was found in Ansible Tower when running Openshift. A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. A flaw was found in ansible. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. In an environment where logs are shared with other parties, this could lead to privilege escalation. Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2. A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that disables host key verification by default. openssl_privatekey_info exposes private key in logs. Use of this information constitutes acceptance for use in an AS IS condition. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection. Tower runs a memcached, which is accessed via TCP. A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6. 
An attacker can take advantage of this information to steal those credentials. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Terms of Use | The highest threat from this vulnerability is to confidentiality. A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed. A flaw was found in the use of insufficiently random values in Ansible. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doTestTowerConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6. This could result in a loss of confidentiality of the system among other issues. Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. The highest threat from this vulnerability is to confidentiality. This flaw allows an attacker to steal bitbucket_pipeline credentials. Any secret information in an async status file will be readable by a malicious user on that system. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. vulnerability certification why scanner hat A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. These files include both the SECRET_KEY and the database backup. A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. The highest threat from this vulnerability is data confidentiality. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license. A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. Some of these fields in GCP modules are not set properly. A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. A flaw was found in the pipe lookup plugin of ansible. Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/. This is fixed in Ansible version 3.7.1. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known instances of this being exploited. Ansible) and remove those mounts from the DaemonSet manifest. It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. A flaw was found in Ansible Galaxy Collections. This flaw allows unauthorized users to read this data. An exposure of sensitive information flaw was found in Ansible version 3.7.0. An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. Ideally TURN servers should be deployed in an isolated fashion where they can only reach what they need to reach to perform their task of assisting NAT-traversal. The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This flaw allows an attacker to obtain sensitive information. nginx hardening When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts. ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. The highest threat from this vulnerability is to confidentiality. Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. : CVE-2009-1234 or 2010-1234 or 20101234), Take a third party risk management course for FREE, How does it work? A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. You are only vulnerable if you have an additional vulnerability (e.g. A flaw was found in ansible-tower. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. This flaw affects Ansible Engine versions before 2.9.6. A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. An attacker could take advantage to overwrite any file within the system. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657. Any use of this information is at the user's risk. A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Ansible prior to 1.5.4 mishandles the evaluation of some strings. This flaw allows attackers to perform command injection, which discloses sensitive information. bluemix websphere ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. A flaw was found in ansible 2.8.0 before 2.8.4. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/. A flaw was found in the Ansible Engine when using module_args. One should also make sure that the TURN server is set up with firewall rules so that it cannot relay to other addresses that you don't want the TURN server to relay to. This directory is created with "umask 77 && mkdir -p "; this operation does not fail if the directory already exists and is owned by another user. The highest threat from this vulnerability is to data confidentiality. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. Files would remain in the bucket exposing the data. Once published, anyone who downloads or installs the collection can view the secrets. firewall waf If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. The main threat from this vulnerability is data confidentiality. A flaw was found in Ansible Tower in versions before 3.7.2. A flaw was found in Ansible where the secret information present in async_files are getting disclosed when the user changes the jobdir to a world readable directory. A flaw was found in Ansible Collection community.crypto. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. Malicious code could craft the filename parameter to perform OS command injections. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. Corporation. You can also search by reference using the, Cybersecurity and Infrastructure Security Agency, The MITRE EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. This contains sensitive info, such as the user's Ansible Galaxy API key and any secrets in ``ansible`` or ``ansible-playbook`` verbose output without the``no_log`` redaction. Use of the CVE List and the associated references from this website are subject to the terms of use. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback). When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. Passwords should be wrapped to prevent templates trigger and exposing them. This site will NOT BE LIABLE FOR ANY DIRECT, The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. The `turn` module can be disabled. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system. An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-. An attacker could use this vulnerability to gain admin level access to the database. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). An authorization flaw was found in Foreman Ansible. ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. TURN is only used as a last resort when other NAT traversal options do not work. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. Restund is an open source NAT traversal server. Showing those credentials in clear text form for every user which have access just to the process list. 
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data. The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. A missing permission check in Jenkins Ansible Tower Plugin 0.9.1 and earlier in the TowerInstallation.TowerInstallationDescriptor#doFillTowerCredentialsIdItems method allowed attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins. The highest threat from this vulnerability is to confidentiality. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. The highest threat from this vulnerability is to confidentiality and integrity. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every credential stored in Tower. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
Sitemap 31
