[RHSA-2023:4693-01] Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Advisory ID: RHSA-2023:4693-01
Product: Red Hat Ansible Automation Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4693
Issue date: 2023-08-21
CVE Names: CVE-2023-4380 CVE-2023-23931 CVE-2023-32681
CVE-2023-36053
=====================================================================
1. Summary:
An update is now available for Red Hat Ansible Automation Platform 2.4
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Ansible Automation Platform 2.4 for RHEL 8 - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Ansible Automation Platform 2.4 for RHEL 9 - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
Red Hat Ansible Automation Platform provides an enterprise framework for
building, deploying and managing IT automation at scale. IT Managers can
provide top-down guidelines on how automation is applied to individual
teams, while automation developers retain the freedom to write tasks that
leverage existing knowledge without the overhead. Ansible Automation
Platform makes it possible for users across an organization to share, vet,
and manage automation content by means of a simple, powerful, and agentless
language.
Security Fix(es):
* automation-eda-controller: token exposed at importing project
(CVE-2023-4380)
* python3-cryptography/python39-cryptography: memory corruption via
immutable objects (CVE-2023-23931)
* python3-django/python39-django: Potential regular expression denial of
service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)
* python3-requests/python39-requests: Unintended leak of
Proxy-Authorization header (CVE-2023-32681)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional changes for Event-Driven Ansible:
* automation-eda-controller has been updated to 1.0.1
* Fixed Contributor and editor roles cannot set the AWX token (AAP-11573)
* Onboarding journey wizard does not request a controller token creation
(AAP-11907)
* Wrong count of “restarts” field (AAP-12042)
* Filtering on any list only works for items in view (AAP-12446)
* Missing audit records in a running activations with many firings
(AAP-12522)
* When a job template fails the event payload is missing key attributes
(AAP-12529)
* Fix a git token leak when the import project fails. (AAP-12767)
* Restart policy in k8s doesn’t restart successful activations that are
marked as failed (AAP-12862)
* Inconsistent status when disabling/enabling activations (AAP-12896)
* run_job_template action fails and the rule is not counted as fired
(AAP-12909)
* Bulk deletion on rulebook activation list is not consistent (AAP-13093)
* Rulebook Activation link is not functioning in Rule Audit Detail Screen
(AAP-13182)
* Previously project credentials couldn't be updated if there was a change
to the credential used in the project, now credentials can be updated in a
project with a new or different credential. (AAP-13983)
4. Solution:
Red Hat Ansible Automation Platform
5. Bugs fixed ( https://bugzilla.redhat.com/):
2171817 - CVE-2023-23931 python-cryptography: memory corruption via immutable objects
2209469 - CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
2232324 - CVE-2023-4380 Ansible: token exposed at importing project
6. Package List:
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
automation-eda-controller-1.0.1-1.el8ap.src.rpm
python3x-cryptography-38.0.4-2.el8ap.src.rpm
python3x-django-3.2.20-1.el8ap.src.rpm
python3x-requests-2.31.0-1.el8ap.src.rpm
python3x-rsa-4.7.2-1.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
noarch:
automation-eda-controller-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el8ap.noarch.rpm
python39-django-3.2.20-1.el8ap.noarch.rpm
python39-requests-2.31.0-1.el8ap.noarch.rpm
python39-rsa-4.7.2-1.el8ap.noarch.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
automation-eda-controller-1.0.1-1.el9ap.src.rpm
python-cryptography-38.0.4-2.el9ap.src.rpm
python-django-3.2.20-1.el9ap.src.rpm
python-requests-2.31.0-1.el9ap.src.rpm
python-rsa-4.7.2-1.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
noarch:
automation-eda-controller-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el9ap.noarch.rpm
python3-django-3.2.20-1.el9ap.noarch.rpm
python3-requests-2.31.0-1.el9ap.noarch.rpm
python3-rsa-4.7.2-1.el9ap.noarch.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
python-cryptography-38.0.4-2.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
python-cryptography-38.0.4-2.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2023-4380
https://access.redhat.com/security/cve/CVE-2023-23931
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-36053
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is [secalert@redhat.com]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
--
A Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update has been released.
