Red Hat Security Advisory 2020-3328-01 ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on August 5th, 2020 📆 | 5398 Views ⚑

0

Red Hat Security Advisory 2020-3328-01 ≈ Packet Storm

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Ansible Tower 3.7.2-1 – RHEL7 Container
Advisory ID: RHSA-2020:3328-01
Product: Red Hat Ansible Tower
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3328
Issue date: 2020-08-05
CVE Names: CVE-2020-14327 CVE-2020-14328 CVE-2020-14329
CVE-2020-14337
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.7.2-1 – RHEL7 Container

2. Description:

* Updated Named URLs to allow for testing the presence or absence of
objects (CVE-2020-14337)
* Fixed Tower Server Side Request Forgery on Credentials (CVE-2020-14327)
* Fixed Tower Server Side Request Forgery on Webhooks (CVE-2020-14328)
* Fixed Tower sensitive data exposure on labels (CVE-2020-14329)
* Added local caching for downloaded roles and collections so they are not
re-downloaded on nodes where they have already been updated
* Fixed Tower’s task scheduler to no longer deadlock for clustered
installations with large numbers of nodes
* Fixed the Credential Type definitions to no longer allow superusers to
run unsafe Python code
* Fixed credential lookups from CyberArk AIM to no longer fail unexpectedly
* Fixed upgrades from 3.5 to 3.6 on RHEL8 in order for PostgreSQL client
libraries to be upgraded on Tower nodes, which fixes the backup/restore
function
* Fixed backup/restore for PostgreSQL usernames that include capital
letters
* Fixed manually added host variables to no longer be removed on VMWare
vCenter inventory syncs
* Fixed Red Hat Satellite inventory syncs to allow Tower to properly
respect the “verify_ssl flag“

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1856785 – CVE-2020-14327 Tower: SSRF: Server Side Request Forgery on Credential
1856786 – CVE-2020-14328 Tower: SSRF: Server Side Request Forgery on webhooks
1856787 – CVE-2020-14329 Tower: Sensitive Data Exposure on Label
1859139 – CVE-2020-14337 Tower: Named URLs allow for testing the presence or absence of objects

5. References:

https://access.redhat.com/security/cve/CVE-2020-14327
https://access.redhat.com/security/cve/CVE-2020-14328
https://access.redhat.com/security/cve/CVE-2020-14329
https://access.redhat.com/security/cve/CVE-2020-14337
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXyrHBdzjgjWX9erEAQgLIg/7B7BH4F4OJ1pVOotbXrBG0xtkzBLi2vm1
q1Djb6jZWXB9wGOLCWYZC2U7x7kr+T2gjM+Sa3NH1V+wWHn5kEqm+rMioCx5UQd6
18myFb1lGDM/MzaZi8Ovh1EADrFn4QoiTeKoRxc3TIl6bW4M303P3zUTu8N9EtOk
ddk5uV+oWtIND5m5m0uuYCNGqPOm4fwKk4H1oovCKQEGnOdy1H4dOV+mBpOfj3KS
NWqa0vPIjcWXcMR+qgDJmq1q8+56yg7CPwEsa70cU+aV8QZdS8pcK3CZ5ZsNdCyj
Fk+H5mIFmSUTAZX7fBpEljhXaLIzZXAAruHUwwnCJYRa1rq/P0fD8vv+z5vWWb9w
Ige13tCL63KmCHniGDu1FLi9gx/TIO04Arx295jFyUQNLu7NmtK/BGSanJEJ8G9A
g+BumOymOJTnBqNGc0hdD67e0eCTWAVwPvo9uaNccfD0bQNAKaxVwwJmJRG3xukS
Ru/8HGgr+ujz+vW2Ly49JIXWzVoLaWzZgv5LZAeIJToXRS5fkabcTqO1aCYa0+JA
qx7JVYa01o+yUv2cLjFZKHgXFTL41U/gPQ6LTsloFOdGsNmHYmwxkxTLXGNmVCj1
wPQDILeMYeyTsg9SvfVXzhs6TCeWBtudllHaoduoygT+AwaHw0wLxhkwgpCpubqa
MLz0UhqOJEU=
=0wzO
—–END PGP SIGNATURE—–


RHSA-announce mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/rhsa-announce

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...