CVE-2019-3869

Summary

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

Affected Software

VendorProductVersion RangeStatus
Red HatTower3.3.5affected
Red HatTower3.4.3affected

Weaknesses

  • CWE-214: CWE-214

ADP Enrichment

CVE Program Container

Additional References

References