Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update

Fixed packages 20

Vulnerabilities 4

• High 7.5
  CVE-2024-22189

  QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

  quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to e…

  quic-go quic-go k3s caddy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 4, 2024
• High 7.5
  CVE-2024-41989

  Django memory consumption vulnerability

  An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Aug 7, 2024
• High 7.5
  CVE-2024-45230 EPSS 26%

  Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters

  An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Oct 8, 2024
• Medium 6.1
  CVE-2024-10033

  Aap-gateway: xss on aap-gateway

  A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecti…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Oct 16, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2302433
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2314485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2319162
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8534.json
• report
  https://access.redhat.com/security/cve/CVE-2024-10033
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-10033
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-10033
• report
  https://access.redhat.com/security/cve/CVE-2024-22189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-22189
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-22189
• article
  https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a
• article
  https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478
• article
  https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management
• report
  https://access.redhat.com/security/cve/CVE-2024-41989
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-41989
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-41989
• report
  https://access.redhat.com/security/cve/CVE-2024-45230
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45230
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45230