Insecure Communication Configuration in Ansible Tower (Red Hat)
CVE-2018-16879

7.3HIGH

Key Information:

Vendor

[unknown]

Status
Tower
Vendor
CVE Published:
3 January 2019

What is CVE-2018-16879?

Ansible Tower versions prior to 3.3.3 are configured with insecure communication settings, allowing messaging between Celery workers and RabbitMQ to occur over a non-secure channel. This vulnerability can lead to exposure of sensitive data, such as passwords, and potential exploits including denial of service attacks by manipulating project or inventory files.

Affected Version(s)

Tower 3.3.3

References

http://www.securityfocus.com/bid/106310
vdb-entryx_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.