Headline
RHSA-2023:4971: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2023-23931: A vulnerability was found in python-cryptography. In affected versions,
Cipher.update_intowould accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such asbytes) to be mutated, thus violating the fundamental rules of Python, resulting in corrupted output. - CVE-2023-40267: An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution.
Issued:
2023-09-05
Updated:
2023-09-05
RHSA-2023:4971 - Security Advisory
- Overview
- Updated Packages
Synopsis
Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Type/Severity
Security Advisory: Moderate
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update is now available for Red Hat Ansible Automation Platform 2.4
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Security Fix(es):
- automation-controller: cryptography: memory corruption via immutable objects (CVE-2023-23931)
- automation-controller: GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)
- python3-gitpython/python39-gitpython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional changes:
- ansible-core has been updated to 2.15.3 (AAP-15269)
- automation-controller has been updated to 4.4.3 (AAP-15549)
- python3-gitpython/python39-gitpython has been updated to 3.1.21 (AAP-15485)
- automation controller: Fix bug that can cause a deadlock on shutdown when redis is unavailable. (AAP-14203)
- automation controller: The login form no longer supports autocomplete on the password field due to security concerns. (AAP-15545)
Solution
Red Hat Ansible Automation Platform
Affected Products
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 x86_64
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 s390x
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ppc64le
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 aarch64
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 x86_64
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 s390x
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ppc64le
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 aarch64
- Red Hat Ansible Inside 1.2 for RHEL 9 x86_64
- Red Hat Ansible Inside 1.2 for RHEL 9 s390x
- Red Hat Ansible Inside 1.2 for RHEL 9 ppc64le
- Red Hat Ansible Inside 1.2 for RHEL 9 aarch64
- Red Hat Ansible Inside 1.2 for RHEL 8 x86_64
- Red Hat Ansible Inside 1.2 for RHEL 8 s390x
- Red Hat Ansible Inside 1.2 for RHEL 8 ppc64le
- Red Hat Ansible Inside 1.2 for RHEL 8 aarch64
- Red Hat Ansible Developer 1.1 for RHEL 9 x86_64
- Red Hat Ansible Developer 1.1 for RHEL 9 s390x
- Red Hat Ansible Developer 1.1 for RHEL 9 ppc64le
- Red Hat Ansible Developer 1.1 for RHEL 9 aarch64
- Red Hat Ansible Developer 1.1 for RHEL 8 x86_64
- Red Hat Ansible Developer 1.1 for RHEL 8 s390x
- Red Hat Ansible Developer 1.1 for RHEL 8 ppc64le
- Red Hat Ansible Developer 1.1 for RHEL 8 aarch64
Fixes
- BZ - 2171817 - CVE-2023-23931 python-cryptography: memory corruption via immutable objects
- BZ - 2231474 - CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
Red Hat Ansible Automation Platform 2.4 for RHEL 9
SRPM
ansible-core-2.15.3-1.el9ap.src.rpm
SHA-256: 54fd4ef996747cf353682d92a6f3135170e7bce6e23e4378bfae87e25ac23f30
automation-controller-4.4.3-1.el9ap.src.rpm
SHA-256: 73fe82d8fc04e50c630f8830343de42cc1fa565f0e4b3f82108168dba7d797be
python-gitpython-3.1.32-1.el9ap.src.rpm
SHA-256: 482a18ff344f68ded2983081394ef525411ecc24fa7b22eee763489cb5f8a924
x86_64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ansible-test-2.15.3-1.el9ap.noarch.rpm
SHA-256: 85ec3d06ae92feb07ab39dd1c0906350939dc2c4756b98c4e88603fecb3b56fa
automation-controller-4.4.3-1.el9ap.x86_64.rpm
SHA-256: 6fd106b4cb3f68e1881d96cdf4e0b630ccd9d5ebcb5a3c240be28a6981ac0a8c
automation-controller-cli-4.4.3-1.el9ap.noarch.rpm
SHA-256: 7dc2a19b1c145564969db335a93885170a473e01e67390895b6d3f151c408139
automation-controller-server-4.4.3-1.el9ap.noarch.rpm
SHA-256: 1af8d9114a215a41c85cf5b440eaa76b30146e89032ec7ed3d80b3d2edef98de
automation-controller-ui-4.4.3-1.el9ap.noarch.rpm
SHA-256: e9ed2b4ccad021047ed7e3e9d339282ffb6b6832a47bb99f76bdd8c42f648a78
automation-controller-venv-tower-4.4.3-1.el9ap.x86_64.rpm
SHA-256: 4eb4382953d00fb665c00477147ee39154e96522d4667cc003391926fd4a04d4
python3-gitpython-3.1.32-1.el9ap.noarch.rpm
SHA-256: 16ce64cf5c5f4d2c36d9193c79a64ff07159a70b4f7303ddadc2b87180c87510
s390x
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ansible-test-2.15.3-1.el9ap.noarch.rpm
SHA-256: 85ec3d06ae92feb07ab39dd1c0906350939dc2c4756b98c4e88603fecb3b56fa
automation-controller-4.4.3-1.el9ap.s390x.rpm
SHA-256: 8393a84c6ecbfff80e758cfb44fdae4158efbe2b6f3e33f639e7231ebb8568dd
automation-controller-cli-4.4.3-1.el9ap.noarch.rpm
SHA-256: 7dc2a19b1c145564969db335a93885170a473e01e67390895b6d3f151c408139
automation-controller-server-4.4.3-1.el9ap.noarch.rpm
SHA-256: 1af8d9114a215a41c85cf5b440eaa76b30146e89032ec7ed3d80b3d2edef98de
automation-controller-ui-4.4.3-1.el9ap.noarch.rpm
SHA-256: e9ed2b4ccad021047ed7e3e9d339282ffb6b6832a47bb99f76bdd8c42f648a78
automation-controller-venv-tower-4.4.3-1.el9ap.s390x.rpm
SHA-256: 62706dd26c2d70df8a65626185767de817facaaa5c63b6e549bbe49807bfde7e
python3-gitpython-3.1.32-1.el9ap.noarch.rpm
SHA-256: 16ce64cf5c5f4d2c36d9193c79a64ff07159a70b4f7303ddadc2b87180c87510
ppc64le
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ansible-test-2.15.3-1.el9ap.noarch.rpm
SHA-256: 85ec3d06ae92feb07ab39dd1c0906350939dc2c4756b98c4e88603fecb3b56fa
automation-controller-4.4.3-1.el9ap.ppc64le.rpm
SHA-256: ba3e290dfcd3e446ae4324a10f5766c20db561e83bb0394086eaf28bae9c1fd1
automation-controller-cli-4.4.3-1.el9ap.noarch.rpm
SHA-256: 7dc2a19b1c145564969db335a93885170a473e01e67390895b6d3f151c408139
automation-controller-server-4.4.3-1.el9ap.noarch.rpm
SHA-256: 1af8d9114a215a41c85cf5b440eaa76b30146e89032ec7ed3d80b3d2edef98de
automation-controller-ui-4.4.3-1.el9ap.noarch.rpm
SHA-256: e9ed2b4ccad021047ed7e3e9d339282ffb6b6832a47bb99f76bdd8c42f648a78
automation-controller-venv-tower-4.4.3-1.el9ap.ppc64le.rpm
SHA-256: 44b4c25b7f87c4b12b2c7d333b110741a8809b54605879002d8de08d57f05932
python3-gitpython-3.1.32-1.el9ap.noarch.rpm
SHA-256: 16ce64cf5c5f4d2c36d9193c79a64ff07159a70b4f7303ddadc2b87180c87510
aarch64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ansible-test-2.15.3-1.el9ap.noarch.rpm
SHA-256: 85ec3d06ae92feb07ab39dd1c0906350939dc2c4756b98c4e88603fecb3b56fa
automation-controller-4.4.3-1.el9ap.aarch64.rpm
SHA-256: 7b172ae6daca7d19b6300ade27a5ed6e04965b42d5952b2977cf264a432231b4
automation-controller-cli-4.4.3-1.el9ap.noarch.rpm
SHA-256: 7dc2a19b1c145564969db335a93885170a473e01e67390895b6d3f151c408139
automation-controller-server-4.4.3-1.el9ap.noarch.rpm
SHA-256: 1af8d9114a215a41c85cf5b440eaa76b30146e89032ec7ed3d80b3d2edef98de
automation-controller-ui-4.4.3-1.el9ap.noarch.rpm
SHA-256: e9ed2b4ccad021047ed7e3e9d339282ffb6b6832a47bb99f76bdd8c42f648a78
automation-controller-venv-tower-4.4.3-1.el9ap.aarch64.rpm
SHA-256: dc1ce1108867be91789419db4dde210b56050cfe30093fb2506dceb6b4433cab
python3-gitpython-3.1.32-1.el9ap.noarch.rpm
SHA-256: 16ce64cf5c5f4d2c36d9193c79a64ff07159a70b4f7303ddadc2b87180c87510
Red Hat Ansible Automation Platform 2.4 for RHEL 8
SRPM
ansible-core-2.15.3-1.el8ap.src.rpm
SHA-256: 50426460d5e7c381c2a8321cf6c2ffa12d3aadcdee01ab57192bbdb80a8b1710
automation-controller-4.4.3-1.el8ap.src.rpm
SHA-256: f72dc026c1d86cd4c977c832a9c7189ee06ade11a6c06db78e90af001631ecc7
python3x-gitpython-3.1.32-1.el8ap.src.rpm
SHA-256: a2a5a5ac038d2525fb6f19c5ca3741b606918e8ac4e1b78466da84992a7c8590
x86_64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ansible-test-2.15.3-1.el8ap.noarch.rpm
SHA-256: 94fd4ce8a06d3d75efb03d1a6208ad3e2a204489ae9a8348867e63c37c8337cd
automation-controller-4.4.3-1.el8ap.x86_64.rpm
SHA-256: 7ee4493bf582fc559a9e0c4b55b959dcd2fc17d17e486a661a124a8cac8fc273
automation-controller-cli-4.4.3-1.el8ap.noarch.rpm
SHA-256: da16c4c13ebb677e6f8ba5d9f57b93700e54d139dd224fcbe591aa910e6b7bbb
automation-controller-server-4.4.3-1.el8ap.noarch.rpm
SHA-256: 5e93f6cd7fc440d453d9f85feded585dbb3bdea43c7d27e803b8e62dfe894f04
automation-controller-ui-4.4.3-1.el8ap.noarch.rpm
SHA-256: 2769c573c892126cdcfe061c136248d46ec857e6c07238d41c1e45c934b191be
automation-controller-venv-tower-4.4.3-1.el8ap.x86_64.rpm
SHA-256: 74842ef28c7fda564c9e54b5b8757ff58453dd227da121d52371e19dc69c856c
python39-gitpython-3.1.32-1.el8ap.noarch.rpm
SHA-256: 31b633a7013d57f94bc2c1035308d8eab1de8b0ac61a79e0e7e645bd772fcbf7
s390x
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ansible-test-2.15.3-1.el8ap.noarch.rpm
SHA-256: 94fd4ce8a06d3d75efb03d1a6208ad3e2a204489ae9a8348867e63c37c8337cd
automation-controller-4.4.3-1.el8ap.s390x.rpm
SHA-256: 9d2d89e53bb0aecabf4aa48e7abbf5d8960ee1b672627f64f7ebc4a3b874663f
automation-controller-cli-4.4.3-1.el8ap.noarch.rpm
SHA-256: da16c4c13ebb677e6f8ba5d9f57b93700e54d139dd224fcbe591aa910e6b7bbb
automation-controller-server-4.4.3-1.el8ap.noarch.rpm
SHA-256: 5e93f6cd7fc440d453d9f85feded585dbb3bdea43c7d27e803b8e62dfe894f04
automation-controller-ui-4.4.3-1.el8ap.noarch.rpm
SHA-256: 2769c573c892126cdcfe061c136248d46ec857e6c07238d41c1e45c934b191be
automation-controller-venv-tower-4.4.3-1.el8ap.s390x.rpm
SHA-256: 3f8130cefd2cdee940b8f8ae05441f54b202d032f86800c95abe2bf8550348b2
python39-gitpython-3.1.32-1.el8ap.noarch.rpm
SHA-256: 31b633a7013d57f94bc2c1035308d8eab1de8b0ac61a79e0e7e645bd772fcbf7
ppc64le
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ansible-test-2.15.3-1.el8ap.noarch.rpm
SHA-256: 94fd4ce8a06d3d75efb03d1a6208ad3e2a204489ae9a8348867e63c37c8337cd
automation-controller-4.4.3-1.el8ap.ppc64le.rpm
SHA-256: 8b8ac54bc1c237c43c8e8a88127c82202dcca3cc67ba8fff7e5bcd5e8dbbd5fe
automation-controller-cli-4.4.3-1.el8ap.noarch.rpm
SHA-256: da16c4c13ebb677e6f8ba5d9f57b93700e54d139dd224fcbe591aa910e6b7bbb
automation-controller-server-4.4.3-1.el8ap.noarch.rpm
SHA-256: 5e93f6cd7fc440d453d9f85feded585dbb3bdea43c7d27e803b8e62dfe894f04
automation-controller-ui-4.4.3-1.el8ap.noarch.rpm
SHA-256: 2769c573c892126cdcfe061c136248d46ec857e6c07238d41c1e45c934b191be
automation-controller-venv-tower-4.4.3-1.el8ap.ppc64le.rpm
SHA-256: 29dc1a763ecc6d91a712b46816bcd12d3e00c5474c6ad52ef40fbcb8dd3e2b7e
python39-gitpython-3.1.32-1.el8ap.noarch.rpm
SHA-256: 31b633a7013d57f94bc2c1035308d8eab1de8b0ac61a79e0e7e645bd772fcbf7
aarch64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ansible-test-2.15.3-1.el8ap.noarch.rpm
SHA-256: 94fd4ce8a06d3d75efb03d1a6208ad3e2a204489ae9a8348867e63c37c8337cd
automation-controller-4.4.3-1.el8ap.aarch64.rpm
SHA-256: ffcfbc6baaf5643b61f1e5128876bb22fd5efc204a78161623d28035f2befb59
automation-controller-cli-4.4.3-1.el8ap.noarch.rpm
SHA-256: da16c4c13ebb677e6f8ba5d9f57b93700e54d139dd224fcbe591aa910e6b7bbb
automation-controller-server-4.4.3-1.el8ap.noarch.rpm
SHA-256: 5e93f6cd7fc440d453d9f85feded585dbb3bdea43c7d27e803b8e62dfe894f04
automation-controller-ui-4.4.3-1.el8ap.noarch.rpm
SHA-256: 2769c573c892126cdcfe061c136248d46ec857e6c07238d41c1e45c934b191be
automation-controller-venv-tower-4.4.3-1.el8ap.aarch64.rpm
SHA-256: 71c880b0e323492f13f9042ac9e66ca0853845b05408278781db8906490bb35c
python39-gitpython-3.1.32-1.el8ap.noarch.rpm
SHA-256: 31b633a7013d57f94bc2c1035308d8eab1de8b0ac61a79e0e7e645bd772fcbf7
Red Hat Ansible Inside 1.2 for RHEL 9
SRPM
ansible-core-2.15.3-1.el9ap.src.rpm
SHA-256: 54fd4ef996747cf353682d92a6f3135170e7bce6e23e4378bfae87e25ac23f30
x86_64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
s390x
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ppc64le
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
aarch64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
Red Hat Ansible Inside 1.2 for RHEL 8
SRPM
ansible-core-2.15.3-1.el8ap.src.rpm
SHA-256: 50426460d5e7c381c2a8321cf6c2ffa12d3aadcdee01ab57192bbdb80a8b1710
x86_64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
s390x
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ppc64le
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
aarch64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
Red Hat Ansible Developer 1.1 for RHEL 9
SRPM
ansible-core-2.15.3-1.el9ap.src.rpm
SHA-256: 54fd4ef996747cf353682d92a6f3135170e7bce6e23e4378bfae87e25ac23f30
x86_64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
s390x
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
ppc64le
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
aarch64
ansible-core-2.15.3-1.el9ap.noarch.rpm
SHA-256: b46e41eff2955b0eee6f2c5ee00ab09caf01092ea0345b3c1689dc4c9e2524d7
Red Hat Ansible Developer 1.1 for RHEL 8
SRPM
ansible-core-2.15.3-1.el8ap.src.rpm
SHA-256: 50426460d5e7c381c2a8321cf6c2ffa12d3aadcdee01ab57192bbdb80a8b1710
x86_64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
s390x
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
ppc64le
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
aarch64
ansible-core-2.15.3-1.el8ap.noarch.rpm
SHA-256: c2615eaf8d336d87e59bd477dcf1b3104edd657e99f762ea1f12342f7ef069f7
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
Gentoo Linux Security Advisory 202407-6 - Multiple vulnerabilities have been discovered in cryptography, the worst of which could lead to a denial of service. Versions greater than or equal to 42.0.4 are affected.
Ubuntu Security Notice 6539-1 - It was discovered that the python-cryptography Cipher.update_into function would incorrectly accept objects with immutable buffers. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. It was discovered that python-cryptography incorrectly handled loading certain PKCS7 certificates. A remote attacker could possibly use this issue to cause python-cryptography to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.
Red Hat Security Advisory 2023-7341-01 - An update is now available for Red Hat Quay 3.
Red Hat Security Advisory 2023-7096-01 - An update for python-cryptography is now available for Red Hat Enterprise Linux 8.
Red Hat Security Advisory 2023-5931-01 - Updated Satellite 6.13 packages that fixes Important security bugs and several regular bugs are now available for Red Hat Satellite. Issues addressed include code execution and denial of service vulnerabilities.
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.
Red Hat Security Advisory 2023-4991-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
An update is now available for Red Hat Ansible Automation Platform 2.3 Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-40267: An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution.
Red Hat Security Advisory 2023-4971-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Red Hat Security Advisory 2023-4971-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Ubuntu Security Notice 6326-1 - It was discovered that GitPython did not block insecure options from user inputs in the clone command. An attacker could possibly use this issue to execute arbitrary commands on the host.
Red Hat Security Advisory 2023-4693-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Issues addressed include a denial of service vulnerability.
An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-4380: No description is available for this CVE. * CVE-2023-23931: A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such as `bytes`) to be mutated, thus violating the fundamen...
GitPython before 3.1.32 does not block insecure non-multi options in `clone` and `clone_from`, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).
Dell VxRail, version(s) 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system malfunction.
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through...
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers: ```pycon >>> outbuf = b"\x00" * 32 >>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor() >>> c.update_into(b"\x00" * 16, outbuf) 16 >>> outbuf b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' ``` This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.