Bug 1859139 (CVE-2020-14337)

Summary:	CVE-2020-14337 Tower: Named URLs allow for testing the presence or absence of objects
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cmeyers, gblomqui, gmainwar, mabashia, notting, rpetrell, security-response-team, smcdonal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ansible_tower 3.7.2, ansible_tower 3.8.0	Doc Type:	If docs needed, set a value
Doc Text:	A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-05 19:27:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1859222
Bug Blocks:	1859101

Description Borja Tarraso 2020-07-21 10:31:31 UTC

Ansible Tower automatically associates an alias to a user's email in the API. This means that an attacker can query or search for a user based on their email address. Because of this, it is possible to check and see if an arbitrary user exists.

Comment 1 Borja Tarraso 2020-07-21 10:31:36 UTC

Statement:

Ansible Tower 3.7.1 as well as previous versions are affected.

Comment 2 Borja Tarraso 2020-07-21 10:31:39 UTC

Mitigation:

There is no mitigation for this issue.

Comment 5 Borja Tarraso 2020-07-29 20:45:29 UTC

Acknowledgments:

Name: Joshua Niemann (IBM GTS)

Comment 6 errata-xmlrpc 2020-08-05 14:46:57 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:3328 https://access.redhat.com/errata/RHSA-2020:3328

Comment 7 Product Security DevOps Team 2020-08-05 19:27:52 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14337