Bug 1847843 (CVE-2020-10782) - CVE-2020-10782 Tower: rsyslog configuration has world readable permissions
Summary: CVE-2020-10782 Tower: rsyslog configuration has world readable permissions
Alias: CVE-2020-10782
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1847947
Blocks: 1847831
TreeView+ depends on / blocked
Reported: 2020-06-17 08:01 UTC by Borja Tarraso
Modified: 2020-06-19 05:20 UTC (History)
8 users (show)

Fixed In Version: ansible_tower 3.7.1
Doc Type: If docs needed, set a value
Doc Text:
An exposure of sensitive information flaw was found in Ansible. Sensitive information such as Splunk tokens could be readable in the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality.
Clone Of:
Last Closed: 2020-06-19 05:20:40 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2617 None None None 2020-06-19 01:40:16 UTC

Description Borja Tarraso 2020-06-17 08:01:49 UTC
The /var/lib/awx/rsyslog/rsyslog.conf has world readable permissions which could store some secrets such as the Splunk token. Rsyslog configuration file permissions must be set to 640 instead of 644.

Comment 1 Borja Tarraso 2020-06-17 08:01:53 UTC

* Ansible Tower 3.7.0 is affected.

Comment 5 RaTasha Tillery-Smith 2020-06-17 13:36:04 UTC

Setting manual permissions for the rsyslog.conf file to 0640 would mitigate the issue temporarily. However, be aware that every time the Tower services are restarted, the permissions are restored to 644 after some time.

Comment 6 errata-xmlrpc 2020-06-19 01:40:14 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:2617 https://access.redhat.com/errata/RHSA-2020:2617

Comment 7 Product Security DevOps Team 2020-06-19 05:20:40 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.