[RHSA-2019:4242-01] Important: Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container
Advisory ID:       RHSA-2019:4242-01
Product:           Red Hat Ansible Tower
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:4242
Issue date:        2019-12-16
CVE Names:         CVE-2019-14864 CVE-2019-19340 CVE-2019-19341 
                   CVE-2019-19342 
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.5.4-1 - RHEL7 Container

2. Description:

* Added a command to generate a new SECRET_KEY and rekey the database 
* Removed the guest user from the optionally-configured RabbitMQ admin
interface (CVE-2019-19340)
* Fixed assorted issues with preserving permissions in the Ansible Tower
backup playbook (CVE-2019-19341)
* Fixed a partial password disclosure when special characters existed in
the RabbitMQ password (CVE-2019-19342)
* Fixed a file descriptor leak in the Tower service during project updates
* Fixed an issue where AUTHORIZATION_CODE_EXPIRE_SECONDS and
ACCESS_TOKEN_EXPIRE_SECONDS were not properly honored
* Fixed an issue where some timezones in schedules could not be parsed
* Fixed isolated execution of playbooks with blanks in the filename
* Fixed saving of workflow extra_vars
* Updated Ansible Tower to disallow Jinja in inventory hostnames
* Updated analytics data collection to match Ansible Tower 3.6
* Updated bundled oVirt SDK to version 4.3.0

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1782623 - CVE-2019-19342 Tower: special characters in RabbitMQ passwords causes web socket 500 error
1782624 - CVE-2019-19340 Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly
1782625 - CVE-2019-19341 Tower: intermediate files during Tower backup are world-readable

5. References:

https://access.redhat.com/security/cve/CVE-2019-14864
https://access.redhat.com/security/cve/CVE-2019-19340
https://access.redhat.com/security/cve/CVE-2019-19341
https://access.redhat.com/security/cve/CVE-2019-19342
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXffOX9zjgjWX9erEAQhvew//VfJgHom06V9Aut5W0CRjEM7ZTV5iaFI/
UFs5HTVthpMvRCwa+98ZJ8jq71Rwzc7QkKL+1g3YMCvMymKTJPMUSx2yHL7toIaR
nk++xVNDzBjtq7dVBiPKyCoEi74UIa8/Zuj36hRaFxwiwsysj1TpLf/B81cUuupx
Lmo32wCDNCq0tYlqxt6ytS9rBn8UmafxvuKWMIZaWpB787/kpVNnYNrn+/Cv9Bfn
DA4Xy3U9AVeNAesbVkWgC/wpPi9aqNbyrrodVpJWTAZ1spkwdTk9XtusGRpLx51Q
InWD53RufFb4Xdd5+kZZBh1Bszw3h6XTknFKX9vWVp0aw725CgVsEoYnV9Fn0zHr
JkuCBwgr+CQgJQV3C6D4N+QYlMVuZlfW0fWgpaGgMuGVg4akl/DGmbmB+Jy9GJ/2
cr1NUDiR1TdaQa0pVnbx72Pr2OZiBi1r8aUm/jeUBC64b9NtAsLQUZSeFuCU4UwX
+7auNV+pCWwrknYWIJ+VAIhwWGO5vYVvRU9XbwG4JQ3g2HISoRXHvy1x1jk4eGkX
Xh5wAQtXKI28lSJill8TQjGX6TjsH1mLnGpzGTjl2tIZIasMviEWJzvuUcnhymiO
+sBzL1eAAExmINTJfJW1qeT9NbcD11wkY5JKXPbMhd8Gq9QPl4BndFkuJibVaMpo
thZ59eIYjCI=
=0zy5
-----END PGP SIGNATURE-----