CVE-2018-16879

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311

Affected software

No affected versions have been published.

Timeline

Published: Jan 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-16885.4IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerab CVE-2018-168807.0A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,CVE-2018-168817.5A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptc CVE-2018-168828.8A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is CVE-2018-168835.5sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration par CVE-2018-168848.0A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_CVE-2018-168855.5A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and bu CVE-2018-168868.1etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control CVE-2018-168875.4A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations a CVE-2018-168884.7It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run fro CVE-2018-168897.5Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in l CVE-2018-168907.5libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2