Red Hat Security Advisory

RHSA-2021:0781

Red Hat Ansible Automation Platform 1.2.2 security and bug fix update

Released 2021-03-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Automation Hub 4.2 for RHEL 7 automation-hub-4.2.2-1.el7pc, python-bleach-3.3.0-1.el7pc, python-bleach-allowlist-1.0.3-1.el7pc +9
Red Hat Automation Hub 4.2 for RHEL 8 automation-hub-4.2.2-1.el8pc, python-bleach-3.3.0-1.el8pc, python-bleach-allowlist-1.0.3-1.el8pc +9

Fixes 6 records

TI-2021-06301 CVE-2021-23980 · GHSA-vv2x-vrpj-qqpq

Cross-site scripting in Mozilla Bleach

MEDIUM 60

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argume…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00483 Published 2023-02-16 Fixed in 3.3.0 CWE-79

TI-2021-08825 CVE-2021-27291 · GHSA-pq64-v7f5-gqh8

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely…

LOW 39

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03906 Published 2021-03-17 Partial fix · 2.7.4 CWE-1333

TI-2021-03561 CVE-2021-20270 · GHSA-9w8r-397f-prfh

Infinite loop in python-pygments

LOW 38

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "except…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02759 Published 2021-03-23 Partial fix · 2.7.4 CWE-835

TI-2021-02299 CVE-2021-3281 · GHSA-fvgf-6h6h-3322

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the…

LOW 34

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with a…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07605 Published 2021-02-02 Partial fix · 2.2.18, 3.1.6 +1 CWE-22

TI-2020-12113 CVE-2020-15366 · GHSA-v88g-cgmw-v5xw

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator)…

LOW 30

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.02313 Published 2020-07-15 Partial fix · 6.12.3 CWE-1321

TI-2020-06305 CVE-2020-7789 · GHSA-5fw9-fq32-wv5p

Command injection in node-notifier

LOW 28

This affects the package node-notifier before 9.0.0.

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.01587 Published 2020-12-11 Partial fix · 9.0.0, 8.0.1 CWE-78