-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Advisory ID: RHSA-2023:4693-01 Product: Red Hat Ansible Automation Platform Advisory URL: https://access.redhat.com/errata/RHSA-2023:4693 Issue date: 2023-08-21 CVE Names: CVE-2023-4380 CVE-2023-23931 CVE-2023-32681 CVE-2023-36053 ===================================================================== 1. Summary: An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Automation Platform 2.4 for RHEL 8 - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Ansible Automation Platform 2.4 for RHEL 9 - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-eda-controller: token exposed at importing project (CVE-2023-4380) * python3-cryptography/python39-cryptography: memory corruption via immutable objects (CVE-2023-23931) * python3-django/python39-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053) * python3-requests/python39-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional changes for Event-Driven Ansible: * automation-eda-controller has been updated to 1.0.1 * Fixed Contributor and editor roles cannot set the AWX token (AAP-11573) * Onboarding journey wizard does not request a controller token creation (AAP-11907) * Wrong count of “restarts” field (AAP-12042) * Filtering on any list only works for items in view (AAP-12446) * Missing audit records in a running activations with many firings (AAP-12522) * When a job template fails the event payload is missing key attributes (AAP-12529) * Fix a git token leak when the import project fails. (AAP-12767) * Restart policy in k8s doesn’t restart successful activations that are marked as failed (AAP-12862) * Inconsistent status when disabling/enabling activations (AAP-12896) * run_job_template action fails and the rule is not counted as fired (AAP-12909) * Bulk deletion on rulebook activation list is not consistent (AAP-13093) * Rulebook Activation link is not functioning in Rule Audit Detail Screen (AAP-13182) * Previously project credentials couldn't be updated if there was a change to the credential used in the project, now credentials can be updated in a project with a new or different credential. (AAP-13983) 4. Solution: Red Hat Ansible Automation Platform 5. Bugs fixed (https://bugzilla.redhat.com/): 2171817 - CVE-2023-23931 python-cryptography: memory corruption via immutable objects 2209469 - CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header 2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator 2232324 - CVE-2023-4380 Ansible: token exposed at importing project 6. Package List: Red Hat Ansible Automation Platform 2.4 for RHEL 8: Source: automation-eda-controller-1.0.1-1.el8ap.src.rpm python3x-cryptography-38.0.4-2.el8ap.src.rpm python3x-django-3.2.20-1.el8ap.src.rpm python3x-requests-2.31.0-1.el8ap.src.rpm python3x-rsa-4.7.2-1.el8ap.src.rpm aarch64: python39-cryptography-38.0.4-2.el8ap.aarch64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm noarch: automation-eda-controller-1.0.1-1.el8ap.noarch.rpm automation-eda-controller-server-1.0.1-1.el8ap.noarch.rpm automation-eda-controller-ui-1.0.1-1.el8ap.noarch.rpm python39-django-3.2.20-1.el8ap.noarch.rpm python39-requests-2.31.0-1.el8ap.noarch.rpm python39-rsa-4.7.2-1.el8ap.noarch.rpm ppc64le: python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm s390x: python39-cryptography-38.0.4-2.el8ap.s390x.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm x86_64: python39-cryptography-38.0.4-2.el8ap.x86_64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm Red Hat Ansible Automation Platform 2.4 for RHEL 8: Source: python3x-cryptography-38.0.4-2.el8ap.src.rpm aarch64: python39-cryptography-38.0.4-2.el8ap.aarch64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm ppc64le: python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm s390x: python39-cryptography-38.0.4-2.el8ap.s390x.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm x86_64: python39-cryptography-38.0.4-2.el8ap.x86_64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm Red Hat Ansible Automation Platform 2.4 for RHEL 8: Source: python3x-cryptography-38.0.4-2.el8ap.src.rpm aarch64: python39-cryptography-38.0.4-2.el8ap.aarch64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm ppc64le: python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm s390x: python39-cryptography-38.0.4-2.el8ap.s390x.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm x86_64: python39-cryptography-38.0.4-2.el8ap.x86_64.rpm python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm Red Hat Ansible Automation Platform 2.4 for RHEL 9: Source: automation-eda-controller-1.0.1-1.el9ap.src.rpm python-cryptography-38.0.4-2.el9ap.src.rpm python-django-3.2.20-1.el9ap.src.rpm python-requests-2.31.0-1.el9ap.src.rpm python-rsa-4.7.2-1.el9ap.src.rpm aarch64: python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm noarch: automation-eda-controller-1.0.1-1.el9ap.noarch.rpm automation-eda-controller-server-1.0.1-1.el9ap.noarch.rpm automation-eda-controller-ui-1.0.1-1.el9ap.noarch.rpm python3-django-3.2.20-1.el9ap.noarch.rpm python3-requests-2.31.0-1.el9ap.noarch.rpm python3-rsa-4.7.2-1.el9ap.noarch.rpm ppc64le: python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm s390x: python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm python3-cryptography-38.0.4-2.el9ap.s390x.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm x86_64: python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm Red Hat Ansible Automation Platform 2.4 for RHEL 9: Source: python-cryptography-38.0.4-2.el9ap.src.rpm aarch64: python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm ppc64le: python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm s390x: python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm python3-cryptography-38.0.4-2.el9ap.s390x.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm x86_64: python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm Red Hat Ansible Automation Platform 2.4 for RHEL 9: Source: python-cryptography-38.0.4-2.el9ap.src.rpm aarch64: python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-38.0.4-2.el9ap.aarch64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm ppc64le: python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm s390x: python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm python3-cryptography-38.0.4-2.el9ap.s390x.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm x86_64: python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-38.0.4-2.el9ap.x86_64.rpm python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-4380 https://access.redhat.com/security/cve/CVE-2023-23931 https://access.redhat.com/security/cve/CVE-2023-32681 https://access.redhat.com/security/cve/CVE-2023-36053 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJk5BtDAAoJENzjgjWX9erEeOAP/2mxhopEMcT5/vUYAjm1Mx06 VbSNRev5unwCqqHN2C29xS2JNv0+sazo7JcVIP/2qICLEIBTBxPxGkbmeU5z7KGX pSbhz2WFonv0YaTZ3qHrsk5poaT8K2lY2z4FXjW/qSuAe5EvKkFbD/22Jy+Im7to 0mz618G4QNkbnYU39YVeyI2f+GB0S3eqDof0LANb0BTjJRga/ENnbBBE3/ERBdMD xiHfnyTwaQhtFZgml3g+RXhLWZSHblS2IRbwLHlYA5l8pJgMASgcPHzXRFOZimYr 4/uLFylKr20NJdrjRCJ5sAvOPGaOup7w9jAyrdpturH6fyY3hUoYVuGJJc7dLSu1 6gcz35pxWIVdAFycvamkblWaLrRPKW4f8o6+a9dorEcH98gS4a75mI+LROLyVlr4 jGjVeRrCBY1QBZjD+2duYCw/JoHCncy+uNCVouxpllHhEeq/lw6xmGz8qTx80fnB SZvluOYS6jY1pW+9KZ6ndohuN0mPT4sJogkytCRpurDR2B9P+H7ZTWl+1X7P+oj3 C8NEG9TUmsnFlfM3HsJu+XQqZAEwYdOen1qZXGJwyRJjqi2+81Xe6MQaQsYiRyfU SJHZdsYH0dWP2KeVL1laNfZ+AwzrTNnq09ux0vCcZwaiiK4DtwRveMcFNiL3bF23 EAHghshuHJQsa1nZLp7E =iLN7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce