CVE-2021-4112
Fixed in a distro release EPSS <1%
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Products: redhat ansible_automation_platform_early_access, redhat ansible_automation_platform_text-only_advisories, redhat ansible_tower, redhat ansible_automation_platform
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ansible automation platform 2.0 | ansible-runner | 0:2.0.3-3.el8ap |
| Red Hat ansible automation platform 2.0 | python38-ansible-runner | 0:2.0.3-3.el8ap |
| Red Hat ansible automation platform 2.1 | ansible-runner | 0:2.1.1-2.el8ap |
| Red Hat ansible automation platform 2.1 | python38-ansible-runner | 0:2.1.1-2.el8ap |