Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Fixed packages 2

Vulnerabilities 3

• Medium 6.8
  CVE-2024-28102

  JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

  JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, i…

  Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 6, 2024
• Medium 5.6
  CVE-2024-35195

  Requests `Session` object does not verify requests after making first request with verify=False

  Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

  psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 20, 2024
• Medium 5.4
  CVE-2024-34064 Public exploit

  Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

  Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

  pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  May 6, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268758
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282114
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4522.json
• report
  https://access.redhat.com/security/cve/CVE-2024-28102
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28102
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28102
• article
  https://github.com/latchset/jwcrypto/commit/90477a3b6e73da69740e00b8161f53fea19b831f
• article
  https://github.com/latchset/jwcrypto/security/advisories/GHSA-j857-7rvv-vj97
• report
  https://access.redhat.com/security/cve/CVE-2024-34064
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34064
• article
  https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj
• report
  https://access.redhat.com/security/cve/CVE-2024-35195
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-35195
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-35195
• article
  https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56