Bug 1824033 (CVE-2020-10709) - CVE-2020-10709 Tower: OAuth2 refresh tokens do not respect the expiration
Summary: CVE-2020-10709 Tower: OAuth2 refresh tokens do not respect the expiration
Keywords:
Status: NEW
Alias: CVE-2020-10709
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1824034 1824035
Blocks: 1824028
TreeView+ depends on / blocked
 
Reported: 2020-04-15 06:34 UTC by Borja Tarraso
Modified: 2023-12-01 13:42 UTC (History)
3 users (show)

Fixed In Version: ansible_tower 3.6.4, ansible_tower 3.5.6
Doc Type: If docs needed, set a value
Doc Text:
A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Borja Tarraso 2020-04-15 06:34:38 UTC 
OAuth2 refresh tokens do not respect the expiration specified in REFRESH_TOKEN_EXPIRE_SECONDS.
Comment 3 Borja Tarraso 2020-04-16 08:05:08 UTC 
Acknowledgments:

Name: @sdwru
Comment 4 Borja Tarraso 2020-04-16 08:05:11 UTC 
Statement:

Ansible Tower 3.5.5 and 3.6.3 as well as previous versions are affected.
Comment 5 Borja Tarraso 2020-04-16 08:05:14 UTC 
Mitigation:

Whenever is possible, deleting the user from Ansible Tower is the only way to mitigate the authentication of OAuth2 tokens.
Comment 6 Borja Tarraso 2020-04-16 08:08:10 UTC 
Upstream AWX fix: https://github.com/ansible/awx/issues/6630
Note You need to log in before you can comment on or make changes to this bug.