Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 116

Vulnerabilities 20

• High 8.1
  CVE-2023-50447

  Arbitrary Code Execution in Pillow

  Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Jan 19, 2024
• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-1135

  HTTP Request Smuggling in benoitc/gunicorn

  Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints…

  benoitc benoitc/gunicorn reflex gunicorn Debian Ubuntu Wolfi PyPI
  Apr 16, 2024
• High 7.5
  CVE-2024-26130

  cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did n…

  pyca cryptography py3-cassandra-medusa kubeflow-pipelines Debian Ubuntu Wolfi PyPI
  Feb 21, 2024
• High 7.5
  CVE-2024-30251

  Denial of service when trying to parse malformed POST requests in aiohttp

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and …

  aio-libs aiohttp kserve-storage-controller kserve-agent Debian Ubuntu Azure Linux Wolfi PyPI
  May 2, 2024
• High 7.5
  CVE-2024-4340

  Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

  Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

  kubeflow-pipelines-visualization-server sqlparse sqlparse sqlparse Debian Ubuntu Wolfi PyPI
  Apr 30, 2024
• Medium 6.7
  CVE-2024-28219

  Pillow buffer overflow vulnerability

  In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

  kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI
  Apr 3, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 6.5
  CVE-2024-28849

  Proxy-Authorization header kept across hosts in follow-redirects

  follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…

  follow-redirects follow-redirects lerna kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Mar 14, 2024
• Medium 6.2
  CVE-2024-3651 Public exploit

  Denial of Service via Quadratic Complexity in kjd/idna

  A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

  kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 7, 2024
• Medium 6.1
  CVE-2024-27306

  aiohttp vulnerable to XSS on index pages for static file handling

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for …

  aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 18, 2024
• Medium 5.9
  CVE-2023-49083

  cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

  pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 29, 2023
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.9
  CVE-2024-3772

  Regular expression denial of service in Pydantic < 2.4.0

  Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

  pydantic Pydantic pydantic pydantic Debian Ubuntu PyPI
  Apr 15, 2024
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 5.5
  CVE-2023-5752

  Mercurial configuration injectable in repo revision when installing via pip

  When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial co…

  Pip maintainers pip python3 jwt-tool Debian Azure Linux Wolfi PyPI
  Oct 24, 2023
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024
• Medium 5.3
  CVE-2024-21503

  Black vulnerable to Regular Expression Denial of Service (ReDoS)

  Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input tha…

  black black black black Debian Ubuntu Alpine PyPI
  Mar 19, 2024
• Medium 5.3
  CVE-2024-27351

  Regular expression denial-of-service in Django

  In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a craft…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Mar 15, 2024
• Medium 4.9
  CVE-2024-32879

  social-auth-app-django Improper Handling of Case Sensitivity vulnerability

  Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to …

  python-social-auth social-app-django social-auth-app-django social-auth-app-django Debian Ubuntu PyPI
  Apr 24, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250765
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266045
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269617
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272563
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275106
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275280
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278038
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278710
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282114
• article
  https://issues.redhat.com/browse/AAH-3111
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3781.json
• report
  https://access.redhat.com/security/cve/CVE-2023-5752
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5752
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5752
• article
  https://github.com/pypa/pip/pull/12306
• article
  https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/
• report
  https://access.redhat.com/security/cve/CVE-2023-45288
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45288
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45288
• article
  https://nowotarski.info/http2-continuation-flood/
• advisory
  https://pkg.go.dev/vuln/GO-2024-2687
• advisory
  https://www.kb.cert.org/vuls/id/421644
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341