Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 8

Vulnerabilities 2

• Medium 5.9
  CVE-2023-43804 Public exploit

  `Cookie` HTTP header isn't stripped on cross-origin redirects

  urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `C…

  urllib3 urllib3 python3 dask-gateway Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 4, 2023
• Medium 5.0
  CVE-2024-0690

  Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

  An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may in…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Linux Debian Ubuntu Azure Linux PyPI
  Feb 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/errata/RHSA-2024:0322
• article
  https://access.redhat.com/errata/RHBA-2023:7863
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242493
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259013
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0733.json
• report
  https://access.redhat.com/security/cve/CVE-2023-43804
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43804
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43804
• report
  https://access.redhat.com/security/cve/CVE-2024-0690
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-0690
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-0690
• article
  https://github.com/ansible/ansible/pull/82565