CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.

• CWE-20
• CWE-20

• https://access.redhat.com/errata/RHSA-2017:3005Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12148Issue Tracking, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3005Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12148Issue Tracking, Vendor Advisory

Published

Jul 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12141In ytnef 1.9.2, a heap-based buffer overflow vulnerability w…
• CVE-2017-12142In ytnef 1.9.2, an invalid memory read vulnerability was fou…
• CVE-2017-12143In libquicktime 1.2.4, an allocation failure was found in th…
• CVE-2017-12144In ytnef 1.9.2, an allocation failure was found in the funct…
• CVE-2017-12145In libquicktime 1.2.4, an allocation failure was found in th…
• CVE-2017-12146The driver_override implementation in drivers/base/platform.…7
• CVE-2017-12149In Jboss Application Server as shipped with Red Hat Enterpri…9.8
• CVE-2017-12150It was found that samba before 4.4.16, 4.5.x before 4.5.14, …7.4
• CVE-2017-12151A flaw was found in the way samba client before samba 4.4.16…7.4
• CVE-2017-12152Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-12153A security flaw was discovered in the nl80211_set_rekey_data…
• CVE-2017-12154The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Lin…