Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update

Fixed packages 6

Vulnerabilities 2

• Medium 6.3
  CVE-2024-9902 Public exploit

  Ansible-core: ansible-core user may read/write unauthorized content

  A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivi…

  Red Hat Red Hat Enterprise Linux 10 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Linux Debian Ubuntu Azure Linux PyPI
  Nov 6, 2024
• Medium 5.5
  CVE-2024-8775

  Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

  A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux PyPI
  Sep 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312119
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2318271
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9894.json
• report
  https://access.redhat.com/security/cve/CVE-2024-8775
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8775
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8775
• advisory
  https://github.com/advisories/GHSA-jpxc-vmjf-9fcj
• report
  https://access.redhat.com/security/cve/CVE-2024-9902
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9902
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9902