Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 10

Vulnerabilities 2

• High 7.1
  CVE-2023-5764

  Ansible: template injection

  A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection …

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 1.2 Debian Ubuntu Azure Linux PyPI
  Dec 12, 2023
• Medium 6.3
  CVE-2023-5189

  Hub: insecure galaxy-importer tarfile extraction

  A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritt…

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Satellite 6.15 for RHEL 8 Ubuntu PyPI
  Nov 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2234387
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247629
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7773.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5189
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5189
• report
  https://access.redhat.com/security/cve/CVE-2023-5764
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5764
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5764