Login
Log in using an SSO provider:
Fedora Account System
Red Hat Associate
Login using a Red Hat Bugzilla account
Forgot Password
Create an Account
Red Hat Bugzilla – Bug 2235369
Home
New
Search
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh94 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
[?]
This site requires JavaScript to be enabled to function correctly, please enable it.
Bug 2235369
-
ansible: Blind SQL Injection vulnerability
Summary:
ansible: Blind SQL Injection vulnerability
Keywords
:
Security
Status
:
CLOSED NOTABUG
Alias:
None
Product:
Security Response
Classification:
Other
Component:
vulnerability
Sub Component:
---
Version:
unspecified
Hardware:
All
OS:
Linux
Priority:
high
Severity:
high
Target Milestone:
---
Assignee:
Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
2221743
TreeView+
depends on
/
blocked
Reported:
2023-08-28 15:20 UTC by
Vipul Nair
Modified:
2023-10-04 13:48 UTC (
History
)
CC List:
18 users
(
show
)
adudiak
davidn
epacific
jcammara
jhardy
jneedle
jobarker
kshier
mabashia
osapryki
relrod
simaishi
smcdonal
stcannon
teagle
tfister
yguenane
zsadeh
Fixed In Version:
Doc Type:
If docs needed, set a value
Doc Text:
A blind SQL injection flaw was found in tower API. This issue may allow an attacker to craft a malicious SQL query into the SOCIAL_AUTH_GITHUB_KEY parameter in the /api/v2/settings/all/ endpoint and completely compromise the backend tower SQL database.
Clone Of:
Environment:
Last Closed:
2023-09-18 07:46:15 UTC
Embargoed:
Attachments
(Terms of Use)
Description
Vipul Nair
2023-08-28 15:20:28 UTC
The SQL Injection vulnerability is in SOCIAL_AUTH_GITHUB_KEY parameter.
Note
You need to
log in
before you can comment on or make changes to this bug.