Headline
RHSA-2023:4692: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2023-24580: A memory exhaustion flaw was found in the python-django package. This issue occurs when passing certain inputs, leading to a system crash and denial of service.
- CVE-2023-36053: A regular expression denial of service vulnerability has been found in Django. Email and URL validators are vulnerable to this flaw when processing a very large number of domain name labels of emails and URLs.
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Quarkus
Integration and Automation
All Products
Issued:
2023-08-21
Updated:
2023-08-21
RHSA-2023:4692 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update is now available for Red Hat Ansible Automation Platform 2.4
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Security Fix(es):
- automation-controller: python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)
- automation-controller: python-django: Potential denial-of-service vulnerability in file uploads (CVE-2023-24580)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional changes for automation controller:
- automation-controller has been updated to 4.4.2 (AAP-14609)
- Changing credential types using the dropdown list in the Launch prompt window no longer causes the screen to disappear. (AAP-11444)
- Upgraded python dependencies which include an upgrade from Django 3.2 to 4.2.3, psycopg2 to psycopg3, additional libraries as needed. Also added a new setting in the UI exposing the ``CSRF_TRUSTED_ORIGIN`` settings. (AAP-12345)
- Fixed slow database UPDATE statements on job events table which could cause a task manager timeout. (AAP-12586)
- Adding new labels to a job through prompting now works as expected. (AAP-14204)
- Added ``noopener`` and ``noreferrer`` to Controller UI links that were missing it. (AAP-14345)
- Fixed the broken User Guide link in the Edit Subscription Details page. (AAP-14375)
- Turned off auto-complete on remaining Controller UI forms that were missing that attribute. (AAP-14442)
- The Add button on credentials is now accessible for users with correct permissions. (AAP-14525)
- Fixed unexpected error with adding a new host while using a manifest with size 10. (AAP-14675)
- Fixed the Trial toggle when using a manifest file. (AAP-14675)
- Applied environment variables from the setting ``AWX_TASK_ENV`` when running credential lookup plugins. (AAP-14683)
- Interrupted jobs (like canceled jobs) no longer clear facts from hosts, if the job ran on an execution node. (AAP-14878)
- Using a license that is missing a “usage” attribute no longer returns a 400 error. (AAP-14880)
- Fixed sub-keys under “data” from HashiCorp Vault Secret Lookup responses to check for secrets, if found. (AAP-14946)
- Fixed Ansible facts to retry saving to hosts if there is a database deadlock. (AAP-15021)
Solution
Red Hat Ansible Automation Platform
Affected Products
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 x86_64
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 s390x
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ppc64le
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 aarch64
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 x86_64
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 s390x
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ppc64le
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 aarch64
Fixes
- BZ - 2169402 - CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads
- BZ - 2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
Red Hat Ansible Automation Platform 2.4 for RHEL 9
SRPM
automation-controller-4.4.2-1.el9ap.src.rpm
SHA-256: 7fd6bbe1e63a15d4a016146ce7638f4c4c31403e64ea7f2499ab98805ab02402
x86_64
automation-controller-4.4.2-1.el9ap.x86_64.rpm
SHA-256: f97d6fe458b81c8e5ec12202186c6b71746cf15ed9aa006ef815f30d1f5522d9
automation-controller-cli-4.4.2-1.el9ap.noarch.rpm
SHA-256: 83311f8bfe96227c03ba0aab885cd61723b9b3497ca68301d956b846ac4234ff
automation-controller-server-4.4.2-1.el9ap.noarch.rpm
SHA-256: 52aa8f7f9672e02850868aff10f124daef7049cddc68a294506474de65d51d63
automation-controller-ui-4.4.2-1.el9ap.noarch.rpm
SHA-256: 56a0f8c8c580c3e93483711bd0792808da638448d89a3b95ffbe2bad2462ba49
automation-controller-venv-tower-4.4.2-1.el9ap.x86_64.rpm
SHA-256: e767f351c97366657dd90cac2435431b98bd5640bf4675e747e11ccda42cddfb
s390x
automation-controller-4.4.2-1.el9ap.s390x.rpm
SHA-256: f925ef6978b606621bfe0f756ea3ac7fa42b7284af8577bb6ebbc9c80750a479
automation-controller-cli-4.4.2-1.el9ap.noarch.rpm
SHA-256: 83311f8bfe96227c03ba0aab885cd61723b9b3497ca68301d956b846ac4234ff
automation-controller-server-4.4.2-1.el9ap.noarch.rpm
SHA-256: 52aa8f7f9672e02850868aff10f124daef7049cddc68a294506474de65d51d63
automation-controller-ui-4.4.2-1.el9ap.noarch.rpm
SHA-256: 56a0f8c8c580c3e93483711bd0792808da638448d89a3b95ffbe2bad2462ba49
automation-controller-venv-tower-4.4.2-1.el9ap.s390x.rpm
SHA-256: 4a226950caeb3ba7d1d8a8e0f375e6ec4004e59432d5200f036676e99d13fb38
ppc64le
automation-controller-4.4.2-1.el9ap.ppc64le.rpm
SHA-256: ef868afa4b69d4a268e03776dd94dc831d48345857b3608751da43a700b4b3ef
automation-controller-cli-4.4.2-1.el9ap.noarch.rpm
SHA-256: 83311f8bfe96227c03ba0aab885cd61723b9b3497ca68301d956b846ac4234ff
automation-controller-server-4.4.2-1.el9ap.noarch.rpm
SHA-256: 52aa8f7f9672e02850868aff10f124daef7049cddc68a294506474de65d51d63
automation-controller-ui-4.4.2-1.el9ap.noarch.rpm
SHA-256: 56a0f8c8c580c3e93483711bd0792808da638448d89a3b95ffbe2bad2462ba49
automation-controller-venv-tower-4.4.2-1.el9ap.ppc64le.rpm
SHA-256: 93342e4026dba63411ffba7a76bd069b2ff51bfd62036c0393be0a515a414944
aarch64
automation-controller-4.4.2-1.el9ap.aarch64.rpm
SHA-256: 0f60b9ee562a0320230776c623c8c1b5481e45cb49f33f7d069dbb322b633078
automation-controller-cli-4.4.2-1.el9ap.noarch.rpm
SHA-256: 83311f8bfe96227c03ba0aab885cd61723b9b3497ca68301d956b846ac4234ff
automation-controller-server-4.4.2-1.el9ap.noarch.rpm
SHA-256: 52aa8f7f9672e02850868aff10f124daef7049cddc68a294506474de65d51d63
automation-controller-ui-4.4.2-1.el9ap.noarch.rpm
SHA-256: 56a0f8c8c580c3e93483711bd0792808da638448d89a3b95ffbe2bad2462ba49
automation-controller-venv-tower-4.4.2-1.el9ap.aarch64.rpm
SHA-256: c9208a468e338eefdf232e865684c2910b2ecf06f0e9ba88d927cdac8f44d7e0
Red Hat Ansible Automation Platform 2.4 for RHEL 8
SRPM
automation-controller-4.4.2-1.el8ap.src.rpm
SHA-256: be04b3d827cbe92f452058475b7f0384e79dbad8bfc4b6e2a574b730071ba02f
x86_64
automation-controller-4.4.2-1.el8ap.x86_64.rpm
SHA-256: 07099a6c69257e84626844d6c6407d817da9c5952ed2b649d7138e690b6e12ae
automation-controller-cli-4.4.2-1.el8ap.noarch.rpm
SHA-256: d812de7d8b0ba55975d8f140b8ff674f82601ebeb5b48c579cba376477f9d825
automation-controller-server-4.4.2-1.el8ap.noarch.rpm
SHA-256: dcf323407a2c53636a047c2ebc5722406938248f1d600cc2098ff697e8435c7f
automation-controller-ui-4.4.2-1.el8ap.noarch.rpm
SHA-256: 15565218cdc07eed153ec41388013fdc73a2bc53adc9f10f9fa513e71355fc4e
automation-controller-venv-tower-4.4.2-1.el8ap.x86_64.rpm
SHA-256: f0a1885f9b8db6b60e5b1907b985548b313396f20c67c3dcc07c213b6a9b3adb
s390x
automation-controller-4.4.2-1.el8ap.s390x.rpm
SHA-256: f7162d6c3e1e97acb46d8a1d99876a23bcf79444ccab43f0da49a6d8bebfe024
automation-controller-cli-4.4.2-1.el8ap.noarch.rpm
SHA-256: d812de7d8b0ba55975d8f140b8ff674f82601ebeb5b48c579cba376477f9d825
automation-controller-server-4.4.2-1.el8ap.noarch.rpm
SHA-256: dcf323407a2c53636a047c2ebc5722406938248f1d600cc2098ff697e8435c7f
automation-controller-ui-4.4.2-1.el8ap.noarch.rpm
SHA-256: 15565218cdc07eed153ec41388013fdc73a2bc53adc9f10f9fa513e71355fc4e
automation-controller-venv-tower-4.4.2-1.el8ap.s390x.rpm
SHA-256: c9793d5ebcbf3e4d307de17faf03e005349b5a00b28db580d4dc74add9fad871
ppc64le
automation-controller-4.4.2-1.el8ap.ppc64le.rpm
SHA-256: d1525b24702aaee2d0b88b24e67071b84bd3722662d6dd41e9bfb1a141dc4401
automation-controller-cli-4.4.2-1.el8ap.noarch.rpm
SHA-256: d812de7d8b0ba55975d8f140b8ff674f82601ebeb5b48c579cba376477f9d825
automation-controller-server-4.4.2-1.el8ap.noarch.rpm
SHA-256: dcf323407a2c53636a047c2ebc5722406938248f1d600cc2098ff697e8435c7f
automation-controller-ui-4.4.2-1.el8ap.noarch.rpm
SHA-256: 15565218cdc07eed153ec41388013fdc73a2bc53adc9f10f9fa513e71355fc4e
automation-controller-venv-tower-4.4.2-1.el8ap.ppc64le.rpm
SHA-256: 7401fb605be9311649a24a6c603ab99ef5d3b987b576eda178820c46430bf67c
aarch64
automation-controller-4.4.2-1.el8ap.aarch64.rpm
SHA-256: 94c4021949eaa6c8a875aba482698040255ca36708f69d4674b86c7ee6057c47
automation-controller-cli-4.4.2-1.el8ap.noarch.rpm
SHA-256: d812de7d8b0ba55975d8f140b8ff674f82601ebeb5b48c579cba376477f9d825
automation-controller-server-4.4.2-1.el8ap.noarch.rpm
SHA-256: dcf323407a2c53636a047c2ebc5722406938248f1d600cc2098ff697e8435c7f
automation-controller-ui-4.4.2-1.el8ap.noarch.rpm
SHA-256: 15565218cdc07eed153ec41388013fdc73a2bc53adc9f10f9fa513e71355fc4e
automation-controller-venv-tower-4.4.2-1.el8ap.aarch64.rpm
SHA-256: 7284009c326405afc266a657bb5013b77c6d45e67f3869b8ade2390c6fbf99b4
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Red Hat Security Advisory 2024-1878-03 - An updated version of Red Hat Update Infrastructure is now available. RHUI 4.8 fixes several security an operational bugs, adds some new features and upgrades the underlying Pulp to a newer version. Issues addressed include HTTP request smuggling, crlf injection, denial of service, and traversal vulnerabilities.
Red Hat Security Advisory 2024-0212-03 - An update for python-django is now available for Red Hat OpenStack Platform 17.1. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2023-5931-01 - Updated Satellite 6.13 packages that fixes Important security bugs and several regular bugs are now available for Red Hat Satellite. Issues addressed include code execution and denial of service vulnerabilities.
A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.
Red Hat Security Advisory 2023-4693-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Issues addressed include a denial of service vulnerability.
Red Hat Security Advisory 2023-4692-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Issues addressed include cross site request forgery, denial of service, and remote shell upload vulnerabilities.
An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4380: No description is available for this CVE. * CVE-2023-23931: A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such as `bytes`) to be mutated, thus violating the fundamen...
Debian Linux Security Advisory 5465-1 - Seokchan Yoon discovered that missing sanitising in the email and URL validators of Django, a Python web development framework, could result in denial of service.
Debian Linux Security Advisory 5465-1 - Seokchan Yoon discovered that missing sanitising in the email and URL validators of Django, a Python web development framework, could result in denial of service.
Ubuntu Security Notice 6203-2 - USN-6203-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 18.04 ESM. Seokchan Yoon discovered that Django incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.
Ubuntu Security Notice 6203-1 - Seokchan Yoon discovered that Django incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, `EmailValidator` and `URLValidator` are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Red Hat Security Advisory 2023-2097-03 - Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Issues addressed include code execution, cross site scripting, denial of service, deserialization, improper neutralization, information leakage, and remote shell upload vulnerabilities.
Red Hat Security Advisory 2023-2101-01 - Red Hat Update Infrastructure offers a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red Hat Enterprise Linux instances. Issues addressed include denial of service and remote shell upload vulnerabilities.
An updated version of Red Hat Update Infrastructure (RHUI) is now available. RHUI 4.4 fixes several security and operational bugs, and introduces multiple new features.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-40899: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. * CVE-2023-23969: A flaw was found in python-django. The parsed values of the Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial of service vector via excessive memory usage if large header values are sent. * CVE-2023-24580: A memory exhaustion flaw was found in the python-django package....
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Ubuntu Security Notice 5868-1 - Jakob Ackermann discovered that Django incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.