Home / mailings [RHSA-2019:4242-01] Important: Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container
Posted on 16 December 2019
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Important: Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container
Advisory ID: RHSA-2019:4242-01
Product: Red Hat Ansible Tower
Advisory URL: https://access.redhat.com/errata/RHSA-2019:4242
Issue date: 2019-12-16
CVE Names: CVE-2019-14864 CVE-2019-19340 CVE-2019-19341
CVE-2019-19342
=====================================================================
1. Summary:
Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container
2. Description:
* Added a command to generate a new SECRET_KEY and rekey the database
* Removed the guest user from the optionally-configured RabbitMQ admin
interface (CVE-2019-19340)
* Fixed assorted issues with preserving permissions in the Ansible Tower
backup playbook (CVE-2019-19341)
* Fixed a partial password disclosure when special characters existed in
the RabbitMQ password (CVE-2019-19342)
* Fixed a file descriptor leak in the Tower service during project updates
* Fixed an issue where AUTHORIZATION_CODE_EXPIRE_SECONDS and
ACCESS_TOKEN_EXPIRE_SECONDS were not properly honored
* Fixed an issue where some timezones in schedules could not be parsed
* Fixed isolated execution of playbooks with blanks in the filename
* Fixed saving of workflow extra_vars
* Updated Ansible Tower to disallow Jinja in inventory hostnames
* Updated analytics data collection to match Ansible Tower 3.6
* Updated bundled oVirt SDK to version 4.3.0
3. Solution:
For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html
4. Bugs fixed (https://bugzilla.redhat.com/):
1782623 - CVE-2019-19342 Tower: special characters in RabbitMQ passwords causes web socket 500 error
1782624 - CVE-2019-19340 Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly
1782625 - CVE-2019-19341 Tower: intermediate files during Tower backup are world-readable
5. References:
https://access.redhat.com/security/cve/CVE-2019-14864
https://access.redhat.com/security/cve/CVE-2019-19340
https://access.redhat.com/security/cve/CVE-2019-19341
https://access.redhat.com/security/cve/CVE-2019-19342
https://access.redhat.com/security/updates/classification/#important
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
