—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Critical: Red Hat Ansible Tower 3.6.1-1 – EL7 Container
Advisory ID: RHSA-2019:3958-01
Product: Red Hat Ansible Tower
Advisory URL: https://access.redhat.com/errata/RHSA-2019:3958
Issue date: 2019-11-25
CVE Names: CVE-2019-14890
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.6.1-1 – EL7 Container

2. Description:

Ansible Tower Version 3.6.1
– —————————–

– – Fixed accidental disclosure of Red Hat username and password in
/api/v2/config (CVE-2019-14890)
– – Fixed upgrade failure with bundled installer
– – Fixed license check error when reinstalling over a partially-installed
Tower
– – Fixed database restore when using a PostgreSQL pod
– – Fixed error when CA data was missing for a container group credential
– – Fixed error when a container group job was launched when Tower was out
of capacity
– – Fixed a few minor issues in the AWX modules collection

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1773622 – CVE-2019-14890 Tower: RHSM username and password exposed after license application

5. References:

https://access.redhat.com/security/cve/CVE-2019-14890
https://access.redhat.com/security/updates/classification/#critical

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXdvjjdzjgjWX9erEAQj0hA//S4lYJymrZjbMnZ+ONHUqqpG++ot/1C4Q
cUKJmrxSGepv6j705PztW3q0d1pTKBI64SGHgBnYNWdvCWsl4Qx5X8OStWv029o/
Aakdqn9CpF7eRbztxRxK+S+pYnRdZ4/5I4quDHuA8uEa0yavFdNUPk/e/XzAvqq3
uHhIv1qESCPf/i7f9ym2RMRdCfwnmsn0jbzxJKL5QnjwU/n9rX9E2skkktH8Y9X4
Sd4LYSHLgR8jBDuXuzGpEgq4MhbZfejyOF7xQ/VgjwqxoJ5Z7Wmv54qPdZ6wS284
klN8a0oduETpoLu5fX6+2EntcvKrZV6Dxj8ldcZ/HeQByN3n0RRTK85BWZxTUZKu
wAH24xiqPO4qeXXi0yy2jziLOkO6cgvx2xXSxwR9y1yHNE7B+QClcTiOQF6oIRnR
G3t/xQVTxvJypE0Z9+4iTiRbZvGEVdcMWYYj7i7RtfhcCK542ykSdXoUGaIaVO2Y
xq3D/njSnI9ZDg5qYpuSbKz9YXjveQxxcASwJP1NIMS8/bX22aVe+xtyU0pupvra
0qYVHVwcgKexoOajYZBMP/shisNn2JyL1xZEFLi8ncncJhhmQzjbLvMNXUp9/zQv
OYDYs8Suh8mOqsoJpUyAkOLzgu53kVC6FWx3URU2gaogZ2IrokCp5Dsu8dJag45D
NQ+ywpZzoGM=
=t1tw
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce