Red Hat Ansible Automation Platform 2.4 for RHEL 9 vulnerabilities
11 known vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9 from Red Hat. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Missing Authorization
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the i
- 9.1 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Incomplete List of Disallowed Inputs
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes.
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Improper Neutralization of Argument Delimiters in a Command
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote wi
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Reliance on Untrusted Inputs in a Security Decision
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and
- 9.6 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Server-Side Request Forgery
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a Ha
- 7.5 High severity
net/url: Allocation of Resources Without Limits or Throttling
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded
- 7.5 High severity
aiohttp: Improper Handling of Highly Compressed Data (Data Amplification)
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AI
- 8.1 High severity
Red Hat Ansible Automation Platform 2.4 for…: Cleartext Transmission of Sensitive Information
A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the We
- 7.5 High severity
Red Hat Ansible Automation Platform 2.4 for…: Missing Release of Memory after Effective Lifetime
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects
- 7.8 High severity
Red Hat Ansible Automation Platform 2.4 for…: Improper Neutralization of Special Elements Used in a Template Engine
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection w
- 7.8 High severity
Red Hat Ansible Automation Platform 2.4 for…: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's conf