CVE-2019-19342

5.3MEDIUM

Key Information:

Vendor
Red Hat
Status
Tower
Vendor
CVE Published:
19 December 2019

Summary

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

Affected Version(s)

Tower all ansible_tower versions 3.6.x before 3.6.2

Tower all ansible_tower versions 3.5.x before 3.5.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19342
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.