Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 36

Vulnerabilities 4

• High 7.5
  CVE-2023-36053

  Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

  In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

  python-django django python-django Debian Ubuntu PyPI
  Jul 3, 2023
• Medium 6.3
  CVE-2023-4380

  Platform: token exposed at importing project

  A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality…

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible Ubuntu
  Oct 4, 2023
• Medium 6.1
  CVE-2023-32681 Public exploit

  Unintended leak of Proxy-Authorization header in requests

  Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header…

  psf requests python-pip requests Debian Ubuntu Azure Linux PyPI
  May 26, 2023
• Medium 4.8
  CVE-2023-23931

  Cipher.update_into can corrupt memory in pyca cryptography

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

  pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 7, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2171817
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2209469
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218004
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2232324
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4693.json
• report
  https://access.redhat.com/security/cve/CVE-2023-4380
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4380
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4380
• report
  https://access.redhat.com/security/cve/CVE-2023-23931
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-23931
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-23931
• article
  https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r
• report
  https://access.redhat.com/security/cve/CVE-2023-32681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-32681
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-32681
• article
  https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q
• report
  https://access.redhat.com/security/cve/CVE-2023-36053
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-36053
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-36053
• article
  https://www.djangoproject.com/weblog/2023/jul/03/security-releases/