Red Hat Security Advisory

RHSA-2023:7773

Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Released 2023-12-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core-1:2.15.8-1.el8ap, python39-galaxy-importer-0.4.18-1.el8ap, python3x-galaxy-importer-0.4.18-1.el8ap
Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core-1:2.15.8-1.el9ap, python-galaxy-importer-0.4.18-1.el9ap, python3-galaxy-importer-0.4.18-1.el9ap

Fixes 2 records

TI-2023-05302 CVE-2023-5764 · GHSA-7j69-qfc3-2fq9

Ansible: template injection

LOW 37

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00574 Published 2023-12-12 Partial fix · 1:2.15.8-1.el8ap, 1:2.15.8-1.el9ap +3 CWE-1336

TI-2023-04777 CVE-2023-5189 · GHSA-55g2-vm3q-7w52

Hub: insecure galaxy-importer tarfile extraction

LOW 31

A path traversal vulnerability exists in Ansible when extracting tarballs.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00982 Published 2023-11-14 Fixed in 0.4.18-1.el8ap, 0.4.18-1.el9ap +2 CWE-23