Bug 1856787 (CVE-2020-14329)

Summary:	CVE-2020-14329 Tower: Sensitive Data Exposure on Label
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cmeyers, gblomqui, gmainwar, mabashia, notting, rpetrell, smcdonal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ansible_tower 3.7.2	Doc Type:	If docs needed, set a value
Doc Text:	A data exposure flaw was found in Tower, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-05 19:27:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1856792
Bug Blocks:	1856722

Description Borja Tarraso 2020-07-14 13:19:28 UTC

/api/v2/labels/ endpoint is accessible for every users logged in the systems. In the response, the users can retrieve all the labels of organization that the user cannot access normally. Organization name is also disclosed in this endpoint.

Comment 1 Borja Tarraso 2020-07-14 13:19:32 UTC

Statement:

Ansible Tower 3.7.1 as well as previous versions are affected.

Comment 4 Borja Tarraso 2020-07-20 08:14:25 UTC

Acknowledgments:

Name: Maxime ESCOURBIAC (Michelin CERT team)

Comment 5 errata-xmlrpc 2020-08-05 14:46:53 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:3328 https://access.redhat.com/errata/RHSA-2020:3328

Comment 6 Product Security DevOps Team 2020-08-05 19:27:49 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14329