Advisories · Technology
Red Hat Ansible Automation Platform 2.4 for RHEL 9.
Every CVE that names Red Hat Ansible Automation Platform 2.4 for RHEL 9 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- CWE-184
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Command injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- CWE-807
- CVSS 9.6 CriticalCritical · CVSS 9+
Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- CWE-1295
- CVSS 6.6 Medium
Automation-controller: gain access to the k8s api server via job execution with container group
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Broken access control
- CVSS 8.1 High
Platform: insecure websocket used when interacting with eda server
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Weak cryptography or TLS
- CVSS 7.3 High
Controller: html injection in custom login info
- Red Hat Ansible Automation Platform 2.3 for RHEL 8
- Red Hat Ansible Automation Platform 2.3 for RHEL 9
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Platform: token exposed at importing project
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Information disclosure