Ansible Tower 3.4.x < 3.4.6 / 3.5.x < 3.5.6 / 3.6.x < 3.6.4 Denial of Service Vulnerability

Low Nessus Plugin ID 135182

Synopsis

An IT monitoring application running on the remote host is affected by a Denial of Service vulnerability.

Description

The version of Ansible Tower running on the remote web server is 3.4.x prior to 3.4.6, or 3.5.x prior to 3.5.6, or 3.6.x prior to 3.6.4. It is, therefore, affected by a Denial of Service vulnerability when running Openshift that can reduce memcached and Tower performance.

Solution

Upgrade to Ansible Tower version 3.4.6 / 3.5.6 / 3.6.4 or later.

See Also

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10697

https://access.redhat.com/security/cve/cve-2020-10697

Plugin Details

Severity: Low

ID: 135182

File Name: ansible_tower_3_6_4.nasl

Version: 1.3

Type: combined

Family: CGI abuses

Published: 2020/04/02

Updated: 2020/08/07

Dependencies: 112214, 112215

Risk Information

Risk Factor: Low

CVSS Score Source: CVE-2020-10697

CVSS v2.0

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 3.4

Temporal Score: 3

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ansible:tower

Exploit Ease: No known exploits are available

Patch Publication Date: 2020/03/31

Vulnerability Publication Date: 2020/03/31

Reference Information

CVE: CVE-2020-10697

IAVB: 2020-B-0016-S