Red Hat Security Advisory

RHSA-2023:7517

Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Released 2023-11-27 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor-1.4.3-1.el8ap
Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor-1.4.3-1.el9ap

Fixes 2 records

TI-2023-20464 CVE-2023-39322 · GHSA-892h-r6cr-53g4

Memory exhaustion in QUIC connection handling in crypto/tls

MEDIUM 42

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01345 Published 2023-09-08 Partial fix · 1.21.1 CWE-770

TI-2023-20463 CVE-2023-39321 · GHSA-9v7r-x7cv-v437

Panic when processing post-handshake message on QUIC connections in crypto/tls

MEDIUM 42

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01345 Published 2023-09-08 Partial fix · 1.21.1 CWE-400