Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update

Fixed packages 24

Vulnerabilities 6

• High 7.5
  CVE-2021-20270

  Infinite Loop in Pygments

  An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 23, 2021
• High 7.5
  CVE-2021-27291

  Pygments vulnerable to Regular Expression Denial of Service (ReDoS)

  In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an …

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 17, 2021
• Medium 6.1
  CVE-2021-23980

  Cross-site scripting in Bleach

  A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of t…

  Mozilla Mozilla Bleach bleach python-bleach Debian Ubuntu Alpine PyPI
  Feb 16, 2023
• Medium 5.6
  CVE-2020-15366

  Prototype Pollution in Ajv

  An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…

  node-ajv node-ajv ajv Debian Ubuntu npm
  Jul 15, 2020
• Medium 5.6
  CVE-2020-7789

  Command Injection

  This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

  node-notifier npm
  Dec 11, 2020
• Medium 5.3
  CVE-2021-3281 Public exploit

  Django Directory Traversal via archive.extract

  In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Feb 2, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1857977
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1906853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1919969
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1922136
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0781.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7789
• article
  https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794
• report
  https://access.redhat.com/security/cve/CVE-2020-15366
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-15366
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-15366
• article
  https://snyk.io/vuln/SNYK-JS-AJV-584908
• report
  https://access.redhat.com/security/cve/CVE-2021-3281
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3281
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3281
• report
  https://access.redhat.com/security/cve/CVE-2021-20270
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20270
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20270
• report
  https://access.redhat.com/security/cve/CVE-2021-23980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1925252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23980
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23980
• article
  https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq
• report
  https://access.redhat.com/security/cve/CVE-2021-27291
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1940603
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-27291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-27291