Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 8

Vulnerabilities 4

• High 7.5
  CVE-2024-45296

  path-to-regexp outputs backtracking regular expressions

  path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …

  pillarjs path-to-regexp thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm
  Sep 9, 2024
• High 7.3
  CVE-2024-45801

  Tampering by prototype polution in DOMPurify

  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

  cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm
  Sep 16, 2024
• Medium 6.3
  CVE-2024-9902 Public exploit

  Ansible-core: ansible-core user may read/write unauthorized content

  A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivi…

  Red Hat Red Hat Enterprise Linux 10 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Linux Debian Ubuntu Azure Linux PyPI
  Nov 6, 2024
• Medium 5.5
  CVE-2024-8775

  Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

  A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux PyPI
  Sep 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312119
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2318271
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10762.json
• report
  https://access.redhat.com/security/cve/CVE-2024-8775
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8775
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8775
• advisory
  https://github.com/advisories/GHSA-jpxc-vmjf-9fcj
• report
  https://access.redhat.com/security/cve/CVE-2024-9902
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9902
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9902
• report
  https://access.redhat.com/security/cve/CVE-2024-45296
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45296
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45296
• article
  https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• article
  https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• article
  https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• report
  https://access.redhat.com/security/cve/CVE-2024-45801
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45801
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45801
• article
  https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21
• article
  https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc
• article
  https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674