The /var/lib/awx/rsyslog/rsyslog.conf has world readable permissions which could store some secrets such as the Splunk token. Rsyslog configuration file permissions must be set to 640 instead of 644.
Statement: * Ansible Tower 3.7.0 is affected.
Mitigation: Setting manual permissions for the rsyslog.conf file to 0640 would mitigate the issue temporarily. However, be aware that every time the Tower services are restarted, the permissions are restored to 644 after some time.
This issue has been addressed in the following products: Red Hat Ansible Tower 3.7 for RHEL 7 Via RHSA-2020:2617 https://access.redhat.com/errata/RHSA-2020:2617
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10782
It may be helpful to update the Doc Text for this bug to reference "service provisioning tokens" or similar rather than "Splunk tokens", as this is a bug in Ansible Tower, not Splunk. Splunk users may be unnecessarily alarmed by the current Doc Text, particularly if they are not also Ansible Tower users.
In reply to comment #8: > It may be helpful to update the Doc Text for this bug to reference "service > provisioning tokens" or similar rather than "Splunk tokens", as this is a > bug in Ansible Tower, not Splunk. Splunk users may be unnecessarily alarmed > by the current Doc Text, particularly if they are not also Ansible Tower > users. Hi Brandon, You are right, the statement may lead in some unnecessary confusion. The intention was to give to end customers a possible threat of this flaw, by giving an specific example to them. I updated the doc-text to be more generic, so there is no room for a doubt. Many thanks for your suggestion, it is really appreciated. Borja Tarraso Red Hat Product Security
Thanks very much, Borja!