Security readout for executives and security teams
Plain-English summary
Ansible Tower could run attacker-controlled code if a project pulls playbooks from an SCM repository where an attacker can commit, and the project is not configured to delete before update. The attacker needs repository commit access and Tower must execute the Trojan playbook, so exposure depends on SCM trust boundaries and Tower job workflows.
Executive priority
Treat as high priority for Ansible Tower environments that execute playbooks from shared or loosely controlled repositories. The business risk is code execution under Tower's operating context, but exploitation requires repository commit access and Tower execution, limiting broad internet-driven urgency.
Technical view
CVE-2017-12148 affects Ansible Tower interface handling of SCM repositories before 3.1.5 and 3.2.0. Without the delete-before-update flag, a committed playbook can modify Tower's checked-out repository and add git hooks, leading to arbitrary command or code execution as the Tower runtime user.
Likely exposure
Most exposed environments are Ansible Tower deployments using SCM-backed projects, especially where many users or external teams can commit to upstream playbook repositories. Systems already on vendor-fixed releases or consistently using delete-before-update are less exposed.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires high privileges in the upstream SCM repository and user interaction through Tower executing the malicious playbook, but impact can include full confidentiality, integrity, and availability compromise.
Researcher notes
The core trust boundary is between SCM contributors and the Tower runtime environment. Validation should focus on project configuration, repository permissions, Tower version, and whether job execution could process untrusted commits. Evidence in the bundle is limited to vendor/CVE descriptions and does not include exploitation telemetry.
Mitigation direction
- Review Red Hat RHSA-2017:3005 for the vendor-supported update path.
- Upgrade Ansible Tower versions affected before 3.1.5 and 3.2.0.
- Enable delete-before-update on relevant Tower SCM project definitions where feasible.
- Restrict commit access to playbook repositories used by Tower projects.
- Review vendor guidance before applying compensating controls not documented in sources.
Validation and detection
- Inventory Ansible Tower versions and compare against the affected pre-3.1.5 and pre-3.2.0 range.
- List SCM-backed Tower projects and identify any without delete-before-update enabled.
- Review who has commit access to repositories consumed by Tower projects.
- Check recent Tower job history for projects tied to broadly writable repositories.
- Inspect trusted SCM repositories for unexpected hook-related changes after Tower jobs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-12148 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H1.76Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.4HighVector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2017:3005CVE reference · vendor-advisory, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12148CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.