Red Hat Security Advisory

RHSA-2024:1057

Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Released 2024-02-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-installer-2.4-6.el8ap, ansible-rulebook-1.0.5-1.el8ap, automation-eda-controller-1.0.5-1.el8ap +14
Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-automation-platform-installer-2.4-6.el9ap, ansible-rulebook-1.0.5-1.el9ap, automation-eda-controller-1.0.5-1.el9ap +14

Fixes 9 records

TI-2023-25769 CVE-2023-47627 · GHSA-gfw2-4jvh-wgfg

Request smuggling in aiohttp

HIGH 72

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00857 Published 2023-11-14 Fixed in 3.8.6 CWE-444

TI-2023-26746 CVE-2023-49081 · GHSA-q3qx-c6g2-7pw2

aiohttp's ClientSession is vulnerable to CRLF injection via version

HIGH 65

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00882 Published 2023-11-30 Partial fix · 3.9.0 CWE-20

TI-2023-26747 CVE-2023-49082 · GHSA-qvrw-v9rv-5rjx

aiohttp's ClientSession is vulnerable to CRLF injection via method

MEDIUM 63

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00948 Published 2023-11-29 Partial fix · 3.9.0 CWE-20

TI-2024-16215 CVE-2024-24680 · GHSA-xxj9-f6rv-m3x4

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0…

MEDIUM 42

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01606 Published 2024-02-06 Partial fix · 3.2.24, 4.2.10 +1 CWE-770

TI-2024-01540 CVE-2024-1657 · GHSA-r8mm-5386-h387

Platform: insecure websocket used when interacting with eda server

LOW 37

A flaw was found in the ansible automation platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00378 Published 2024-04-25 Fixed in 2.4, 2.4-6.el8ap +3 CWE-319

TI-2023-23795 CVE-2023-44271 · GHSA-8ghj-p4vj-mr35

An issue was discovered in Pillow before 10.0.0.

LOW 36

An issue was discovered in Pillow before 10.0.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0136 Published 2023-11-03 Fixed in 10.0.0 CWE-770

TI-2024-14788 CVE-2024-22195 · GHSA-h5c8-rqwp-cp95

Jinja vulnerable to Cross-Site Scripting (XSS)

LOW 29

Jinja is an extensible templating engine.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00892 Published 2024-01-11 Partial fix · 3.1.3 CWE-79

TI-2023-28707 CVE-2023-52323 · GHSA-j225-cvw7-qrx7

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP…

LOW 27

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00618 Published 2024-01-05 Partial fix · 3.19.1 CWE-203

TI-2022-19470 CVE-2022-40896 · GHSA-mrwq-x4v8-fh7p

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

LOW 25

A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00519 Published 2023-07-19 Partial fix · 2.15.0 CWE-434