# Security scan of AWX identifies it as RH Tower

**URL:** <https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [December 7, 2018, 4:34pm UTC](https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218 "2018-12-07T16:34:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmakovey](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmakovey](https://forum.ansible.com/u/dmakovey)\
**Post date:** [December 7, 2018, 4:34pm UTC](https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218/1 "2018-12-07T16:34:12Z")

</div>

Hi,

running AWX we've been subject to regular security scan which identified  
AWX instance as a RedHat Tower Instance. Which is not bad, except it  
took AWX instance version (2.1.0) and assumed it was RedHat Tower 2.1.0  
immediately claiming it was vulnerable to certain attacks etc.

As far as I can tell identification comes from this snippet on login page:

\<link rel="shortcut icon" href="/static/assets/favicon.ico?v=2.1.0" /\>

is it possible to eliminate confusion by:

1. configuring AWX to present arbitrary version number?  
2. removing version identification altogether?

---

<div class="post-metadata">

**Author:** ![Markus\_Teufelberger](https://avatars.discourse-cdn.com/v4/letter/m/76d3ee/32.png) [@Markus\_Teufelberger](https://forum.ansible.com/u/Markus_Teufelberger)\
**Post date:** [December 8, 2018, 5:56pm UTC](https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218/2 "2018-12-08T17:56:58Z")

</div>

Just thinking out loud here, but maybe you should fix your security scan software instead? After all, it seems to mis-identify AWX as Tower.

---

<div class="post-metadata">

**Author:** ![David\_Maple](https://avatars.discourse-cdn.com/v4/letter/d/ad7895/32.png) [@David\_Maple](https://forum.ansible.com/u/David_Maple)\
**Post date:** [December 8, 2018, 7:21pm UTC](https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218/3 "2018-12-08T19:21:18Z")

</div>

I have to agree with Markus. Attempting to fool the security scan leaves you in a bad situation. If there is a real vulnerability discovered in the AWX version that you are running, you may not know. If that were exploited, you would be at fault.

---

<div class="post-metadata">

**Author:** ![dmakovey](https://avatars.discourse-cdn.com/v4/letter/d/4da419/32.png) [@dmakovey](https://forum.ansible.com/u/dmakovey)\
**Post date:** [December 10, 2018, 4:57pm UTC](https://forum.ansible.com/t/security-scan-of-awx-identifies-it-as-rh-tower/29218/4 "2018-12-10T16:57:38Z")

</div>

> I have to agree with Markus. Attempting to fool the security scan  
> leaves you in a bad situation. If there is a real vulnerability  
> discovered in the AWX version that you are running, you may not know.  
> If that were exploited, you would be at fault.

that would be a fine move and I would agree with it, but our scan  
appliance is a "black box" as I understand it and not very amiable to  
change ☹