Skip to content
OpenAdvisories
Medium RHSA-2024:7312 3 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Published Oct 1, 2024 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el8 automation-controller-venv-tower 0:4.5.12-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.4::el9 automation-controller-venv-tower 0:4.5.12-1.el9ap

Vulnerabilities 3

  • Medium 6.1
    CVE-2024-21520 Public exploit

    Cross-site Scripting in djangorestframework

    Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.

    djangorestframework djangorestframework djangorestframework Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2024-41810 Scanner template

    HTML injection in HTTP redirect body

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability m…

    twisted twisted twisted twisted Debian Ubuntu Azure Linux PyPI
  • Medium 4.4
    CVE-2024-37891

    Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

    urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…

    urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2292788
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2294457
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300497
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7312.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-21520
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-21520
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-21520
  • report
    https://access.redhat.com/security/cve/CVE-2024-37891
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-37891
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-37891
  • report
    https://access.redhat.com/security/cve/CVE-2024-41810
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-41810
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-41810
  • article
    https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33
  • article
    https://github.com/twisted/twisted/security/advisories/GHSA-cf56-g6w6-pqq2