RHSA-2021:0779 - Security Advisory

Topic

Red Hat Ansible Tower 3.7.5-1 - RHEL7 Container

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Security Fix(es):

• Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253
• Upgraded to a more recent version of autobahn to address CVE-2020-35678.
• Upgraded to a more recent version of nginx to address CVE-2019-20372.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Fixed a bug which can intermittently cause access to encrypted Tower settings to fail, resulting in failed job launches.
• Improved analytics collection to collect the playbook status for all hosts in a playbook run

Solution

For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html

Affected Products

• Red Hat Ansible Automation Platform Text-Only Advisories for RHEL 7 x86_64

Fixes

• BZ - 1790277 - CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page
• BZ - 1911314 - CVE-2020-35678 python-autobahn: allows redirect header injection
• BZ - 1928847 - CVE-2021-20253 ansible-tower: Privilege escalation via job isolation escape

CVEs

• CVE-2019-20372
• CVE-2020-10543
• CVE-2020-10878
• CVE-2020-12723
• CVE-2020-35678
• CVE-2021-20178
• CVE-2021-20180
• CVE-2021-20191
• CVE-2021-20228
• CVE-2021-20253

References

• https://access.redhat.com/security/updates/classification/#important