Approved changes feed: RSS · Atom
cpe:2.3:a:red_hat:tower:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Red Hat (a3686528-5679-55c9-b393-abe45df26bd2) |
|---|---|
| Product | Tower (145a41e9-de44-5380-a264-db031e4bc612) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-3869 |
vulnerable | 2026-06-08 05:13:56.242156 |
Details available
HIGH (7.2)
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Published: 2019-03-28T13:04:59.000Z
Updated: 2024-08-04T19:19:18.595Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19342 |
vulnerable | 2026-06-08 05:13:22.169076 |
Details available
MEDIUM (5.3)
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.
Published: 2019-12-19T20:20:01.000Z
Updated: 2024-08-05T02:16:47.010Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19340 |
vulnerable | 2026-06-08 05:13:22.166128 |
Details available
HIGH (8.2)
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.
Published: 2019-12-19T20:16:46.000Z
Updated: 2024-08-05T02:16:46.967Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.