Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 12

Vulnerabilities 3

• Medium 6.3
  CVE-2023-5115

  Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

  An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 1.2 Debian Ubuntu Azure Linux PyPI
  Dec 18, 2023
• Medium 5.9
  CVE-2023-43665

  Django Denial-of-service in django.utils.text.Truncator

  In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potential…

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Nov 3, 2023
• Medium 5.3
  CVE-2023-41164

  Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

  In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Nov 3, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2233810
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241046
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5758.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5115
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5115
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5115
• report
  https://access.redhat.com/security/cve/CVE-2023-41164
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41164
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41164
• article
  https://www.djangoproject.com/weblog/2023/sep/04/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2023-43665
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43665
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43665
• article
  https://www.djangoproject.com/weblog/2023/oct/04/security-releases/