Bug 1928847 (CVE-2021-20253)
| Summary: | CVE-2021-20253 ansible-tower: Privilege escalation via job isolation escape | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bcoca, chousekn, cmeyers, davidn, gblomqui, jcammara, jhardy, jobarker, mabashia, notting, osapryki, relrod, rpetrell, sdoran, security-response-team, smcdonal, tkuratom |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible-tower 3.8.2, ansible-tower 3.7.5, ansible-tower 3.6.7 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-03-09 21:06:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1931431, 1931432, 1931961 | ||
| Bug Blocks: | 1928848, 1930769 | ||
|
Description
Pedro Sampaio
2021-02-15 16:21:27 UTC
Acknowledgments: Name: Matei Mal Badanoiu (Deloitte Romania) This issue has been addressed in the following products: Red Hat Ansible Tower 3.7 for RHEL 7 Via RHSA-2021:0779 https://access.redhat.com/errata/RHSA-2021:0779 This issue has been addressed in the following products: Red Hat Ansible Tower 3.6 for RHEL 7 Via RHSA-2021:0778 https://access.redhat.com/errata/RHSA-2021:0778 This issue has been addressed in the following products: Red Hat Ansible Tower 3.8 for RHEL 7 Via RHSA-2021:0780 https://access.redhat.com/errata/RHSA-2021:0780 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20253 Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat's Justification for difference in CVSS Score: *AV: In order to perform the attack successfully i.e. elevating the privilege by escaping the isolation requires the project environment readable and writable to the "low_privilege" user which can not be done from outside the isolation environment.It has to be enabled from inside the isolation environment. So, it feels more adequate to set AV:L *UI: Someone needs to execute certain commands from inside the environment.A user interaction feels required. UI:R Red Hat's Justification for difference in CVSS Score: *AV: In order to perform the attack successfully i.e. elevating the privilege by escaping the isolation requires the project environment readable and writable to the "low_privilege" user which can not be done from outside the isolation environment.It has to be enabled from inside the isolation environment. So, it feels more adequate to set AV:L *AC: In order to successfully exploit this vulnerability, an attacker will have to perform a series of exploit both from inside and from outside the isolated environment. So, it feels more adequate to set AC:H *UI: Someone needs to execute certain commands from inside the environment.A user interaction feels required. UI:R |