CVE-2019-19342

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
Red Hat	Tower	all ansible_tower versions 3.6.x before 3.6.2; all ansible_tower versions 3.5.x before 3.5.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19342Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19342Issue Tracking, Vendor Advisory

Timeline

Published: Dec 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193437.5A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due CVE-2019-193446.5There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x ver CVE-2019-193457.8A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the CVE-2019-193467.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before t CVE-2019-193487.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the CVE-2019-193497.8An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in CVE-2019-19359.8A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data CVE-2019-193507.8An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Opens CVE-2019-193517.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the CVE-2019-193527.0An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.CVE-2019-193537.0An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. A CVE-2019-193547.8An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4.