Lucene search

RedhatCVELIST:CVE-2018-16879

HistoryJan 03, 2019 - 2:00 p.m.

CVE-2018-16879

2019-01-0314:00:00

CWE-311

redhat

www.cve.org

CVSS3

7.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

61.7%

JSON

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

CNA Affected

[
  {
    "product": "Tower",
    "vendor": "[UNKNOWN]",
    "versions": [
      {
        "status": "affected",
        "version": "3.3.3"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106310

bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879

CVSS3

7.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

61.7%

JSON

Related for CVELIST:CVE-2018-16879