Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 26

Vulnerabilities 12

• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• High 7.5
  CVE-2024-24680

  Django denial-of-service attack in the intcomma template filter

  An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

  python-django django python-django py3-django Debian Ubuntu Wolfi PyPI
  Feb 6, 2024
• Medium 6.5
  CVE-2023-45857 Public exploit

  Axios Cross-Site Request Forgery Vulnerability

  An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

  node-axios axios node-axios Debian Ubuntu npm
  Nov 8, 2023
• Medium 6.5
  CVE-2024-23829

  aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of p…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 29, 2024
• Medium 5.9
  CVE-2023-49083

  cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

  pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 29, 2023
• Medium 5.9
  CVE-2024-23334 Public exploit Scanner template EPSS 77%

  aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 29, 2024
• Medium 5.4
  CVE-2024-22195

  Jinja vulnerable to Cross-Site Scripting (XSS)

  Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 11, 2024
• Medium 5.3
  CVE-2023-46137

  twisted.web has disordered HTTP pipeline response

  Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endp…

  twisted twisted twisted twisted Debian Ubuntu Azure Linux PyPI
  Oct 25, 2023
• Medium 5.3
  CVE-2023-47627

  Request smuggling in aiohttp

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…

  aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 14, 2023
• Medium 5.3
  CVE-2024-27351

  Regular expression denial-of-service in Django

  In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a craft…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Mar 15, 2024
• Medium 4.0
  CVE-2023-41040

  GitPython blind local file inclusion

  GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if …

  gitpython-developers GitPython gitpython python-git Debian Ubuntu Alpine PyPI
  Aug 30, 2023
• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246264
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2247040
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2249825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2261909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266045
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1640.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39326
• advisory
  https://pkg.go.dev/vuln/GO-2023-2382
• report
  https://access.redhat.com/security/cve/CVE-2023-41040
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-41040
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-41040
• article
  https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
• report
  https://access.redhat.com/security/cve/CVE-2023-45857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45857
• report
  https://access.redhat.com/security/cve/CVE-2023-46137
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-46137
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-46137
• report
  https://access.redhat.com/security/cve/CVE-2023-47627
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-47627
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-47627
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg
• report
  https://access.redhat.com/security/cve/CVE-2023-49083
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-49083
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-49083
• article
  https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a
• article
  https://github.com/pyca/cryptography/pull/9926
• article
  https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97
• report
  https://access.redhat.com/security/cve/CVE-2024-1394