CVE-2018-16879

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-03 · updated 2026-06-17
Weakness: CWE-311

Description

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

Affected products

Tower: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: Tower 3.3.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106310
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879
http://www.securityfocus.com/bid/106310
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879

Get alerted when CVE-2018-16879 or the next vulnerability affects your stack