{
  "threat_severity" : "Moderate",
  "public_date" : "2019-03-26T00:00:00Z",
  "bugzilla" : {
    "description" : "Tower: credentials leaked through environment variables",
    "id" : "1688508",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1688508"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.2",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-214",
  "details" : [ "When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.", "When running Tower on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges." ],
  "acknowledgement" : "Red Hat would like to thank Chris Bertsch (FactSet Research Systems Inc) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "CloudForms Management Engine 5.10",
    "release_date" : "2019-04-23T00:00:00Z",
    "advisory" : "RHSA-2019:0796",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5.10::el7",
    "package" : "ansible-tower-0:3.4.3-1.el7at"
  }, {
    "product_name" : "CloudForms Management Engine 5.10",
    "release_date" : "2019-04-23T00:00:00Z",
    "advisory" : "RHSA-2019:0796",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5.10::el7",
    "package" : "cfme-0:5.10.3.3-1.el7cf"
  }, {
    "product_name" : "CloudForms Management Engine 5.10",
    "release_date" : "2019-04-23T00:00:00Z",
    "advisory" : "RHSA-2019:0796",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5.10::el7",
    "package" : "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf"
  }, {
    "product_name" : "CloudForms Management Engine 5.10",
    "release_date" : "2019-04-23T00:00:00Z",
    "advisory" : "RHSA-2019:0796",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5.10::el7",
    "package" : "cfme-appliance-0:5.10.3.3-1.el7cf"
  }, {
    "product_name" : "CloudForms Management Engine 5.10",
    "release_date" : "2019-04-23T00:00:00Z",
    "advisory" : "RHSA-2019:0796",
    "cpe" : "cpe:/a:redhat:cloudforms_managementengine:5.10::el7",
    "package" : "cfme-gemset-0:5.10.3.3-1.el7cf"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.3 for RHEL 7",
    "release_date" : "2019-04-25T00:00:00Z",
    "advisory" : "RHBA-2019:0884",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.3::el7",
    "package" : "ansible-tower-33/ansible-tower:3.3.5-3"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2019-04-25T00:00:00Z",
    "advisory" : "RHBA-2019:0885",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-34/ansible-tower:3.4.3-4"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2019-04-25T00:00:00Z",
    "advisory" : "RHBA-2019:0885",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-34/ansible-tower-memcached:1.4.15-18"
  }, {
    "product_name" : "Red Hat Ansible Tower 3.4 for RHEL 7",
    "release_date" : "2019-04-25T00:00:00Z",
    "advisory" : "RHBA-2019:0885",
    "cpe" : "cpe:/a:redhat:ansible_tower:3.4::el7",
    "package" : "ansible-tower-34/ansible-tower-messaging:3.7.4-10"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-3869\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-3869\nhttps://github.com/ansible/awx/pull/3505" ],
  "name" : "CVE-2019-3869",
  "csaw" : false
}