Skip to content
OpenAdvisories
Critical RHSA-2023:4971 2 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Published Sep 30, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el8 automation-controller-venv-tower 0:4.4.3-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el8 python39-gitpython 0:3.1.32-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el8 python3x-gitpython 0:3.1.32-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el9 automation-controller-venv-tower 0:4.4.3-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el9 python-gitpython 0:3.1.32-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el9 python3-gitpython 0:3.1.32-1.el9ap

Vulnerabilities 2

  • Critical 9.8
    CVE-2023-40267

    GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

    GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

    gitpython python-git python-git Debian Ubuntu PyPI
  • Medium 4.8
    CVE-2023-23931

    Cipher.update_into can corrupt memory in pyca cryptography

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would a…

    pyca cryptography mitmproxy cryptography Debian Ubuntu Azure Linux Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2171817
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2231474
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4971.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-23931
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-23931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-23931
  • article
    https://github.com/pyca/cryptography/security/advisories/GHSA-w7pp-m8wf-vj6r
  • report
    https://access.redhat.com/security/cve/CVE-2023-40267
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-40267
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-40267
  • advisory
    https://github.com/advisories/GHSA-pr76-5cm5-w9cj