-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: Red Hat Ansible Tower 3.6.1-1 - EL7 Container
Advisory ID:       RHSA-2019:3958-01
Product:           Red Hat Ansible Tower
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3958
Issue date:        2019-11-25
CVE Names:         CVE-2019-14890 
=====================================================================

1. Summary:

Red Hat Ansible Tower 3.6.1-1 - EL7 Container

2. Description:

Ansible Tower Version 3.6.1
- -----------------------------

- - Fixed accidental disclosure of Red Hat username and password in 
  /api/v2/config (CVE-2019-14890)
- - Fixed upgrade failure with bundled installer
- - Fixed license check error when reinstalling over a partially-installed 
  Tower
- - Fixed database restore when using a PostgreSQL pod
- - Fixed error when CA data was missing for a container group credential
- - Fixed error when a container group job was launched when Tower was out 
  of capacity
- - Fixed a few minor issues in the AWX modules collection

3. Solution:

For information on upgrading Ansible Tower, reference the Ansible Tower
Upgrade and Migration Guide:
https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
index.html

4. Bugs fixed (https://bugzilla.redhat.com/):

1773622 - CVE-2019-14890 Tower: RHSM username and password exposed after license application

5. References:

https://access.redhat.com/security/cve/CVE-2019-14890
https://access.redhat.com/security/updates/classification/#critical

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXdvjjdzjgjWX9erEAQj0hA//S4lYJymrZjbMnZ+ONHUqqpG++ot/1C4Q
cUKJmrxSGepv6j705PztW3q0d1pTKBI64SGHgBnYNWdvCWsl4Qx5X8OStWv029o/
Aakdqn9CpF7eRbztxRxK+S+pYnRdZ4/5I4quDHuA8uEa0yavFdNUPk/e/XzAvqq3
uHhIv1qESCPf/i7f9ym2RMRdCfwnmsn0jbzxJKL5QnjwU/n9rX9E2skkktH8Y9X4
Sd4LYSHLgR8jBDuXuzGpEgq4MhbZfejyOF7xQ/VgjwqxoJ5Z7Wmv54qPdZ6wS284
klN8a0oduETpoLu5fX6+2EntcvKrZV6Dxj8ldcZ/HeQByN3n0RRTK85BWZxTUZKu
wAH24xiqPO4qeXXi0yy2jziLOkO6cgvx2xXSxwR9y1yHNE7B+QClcTiOQF6oIRnR
G3t/xQVTxvJypE0Z9+4iTiRbZvGEVdcMWYYj7i7RtfhcCK542ykSdXoUGaIaVO2Y
xq3D/njSnI9ZDg5qYpuSbKz9YXjveQxxcASwJP1NIMS8/bX22aVe+xtyU0pupvra
0qYVHVwcgKexoOajYZBMP/shisNn2JyL1xZEFLi8ncncJhhmQzjbLvMNXUp9/zQv
OYDYs8Suh8mOqsoJpUyAkOLzgu53kVC6FWx3URU2gaogZ2IrokCp5Dsu8dJag45D
NQ+ywpZzoGM=
=t1tw
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce