RedHat: RHSA-2022-5703:01 Important: Red Hat Ansible Automation Pla...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Ansible Automation Platform 1.2 security update
Advisory ID:       RHSA-2022:5703-01
Product:           Red Hat Ansible Automation Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5703
Issue date:        2022-07-25
CVE Names:         CVE-2022-28346 CVE-2022-28347 
=====================================================================

1. Summary:

An update is now available for Red Hat Ansible Automation Platform 1.2

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Automation Hub 4.2 for RHEL 7 - noarch
Red Hat Automation Hub 4.2 for RHEL 8 - noarch

3. Description:

Red Hat Ansible Automation Platform integrates Red Hat’s automation suite
consisting of Red Hat Ansible Tower, Red Hat Ansible Engine, and use-case
specific capabilities for Microsoft Windows,network, security, and more,
along with Software-as-a-Service (SaaS)-based capabilities and features for
organization-wide effectiveness.

Security Fix(es):

* python3-django: Django: SQL injection in QuerySet.annotate(),aggregate()
and extra() (CVE-2022-28346)

* python3-django: Django: SQL injection via QuerySet.explain(options) on
PostgreSQL (CVE-2022-28347)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2072447 - CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
2072459 - CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL

6. Package List:

Red Hat Automation Hub 4.2 for RHEL 7:

Source:
python3-django-2.2.28-1.el7pc.src.rpm

noarch:
python3-django-2.2.28-1.el7pc.noarch.rpm

Red Hat Automation Hub 4.2 for RHEL 8:

Source:
python3-django-2.2.28-1.el8pc.src.rpm

noarch:
python3-django-2.2.28-1.el8pc.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-28346
https://access.redhat.com/security/cve/CVE-2022-28347
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuFjuNzjgjWX9erEAQh/SRAAgwBnMFtj3TNWC+SHf0LPa9GHze+QnHMI
TUxCC2VYhV/alwQVT36uDpBtRuFj/PjX1Y+4zPmwgqFNkQuoW3eKYTxsQdCqr1SF
bD08+B7Hrhzt25QC2PAvMKgae/LMhnPqLfNn4BhPYQpburwHIa+18djwfmSpSdEM
lONbN28j6fbhYEFYM9YS1b7zEE3Cyjcrkg6e4iSm/vyFVIKVANcqXpMD1dgXd41s
pXgBzS8G+KjE20msnwJUqHuR22l1ScbkQb3HxVnfXge1eONKIRUjjlQz2Yk5JFzD
f10SjxyrS3/tGInfLd4v6M9yhQMdFzc6ZSoS9JmeDsKuyDojQFCysTeXHGH7eOAj
ZBDCbLY32FwYuXVknaIDPRCAN8dD7jAWB/N0qxRpfLi3RIQiFFbf9zDNqWwTA9tR
wabfOa7BXbXdF5jYOruAe1y/MJmb6mHf0M1h/iUJ4jn/g0DzUxrwFzdB6Aqc7Rwo
IiUrrZEp1c6IZcn+z2Q9AlQpBXzQSS5WUXNQu5+A/MYGS9lTPF4nflYj5C/YOsXP
mhrwV5VFdEIv7Di7dsYeMWYebbzzR0kIXM6QVqL0Y78pwNfBfqCOLLh049FjNFGL
9uxW1lOj49wPwzhaovfOlGTN7nXelBv7z/GbBFZ7NzQjUP+e/+oH4rGNXhn4fAon
jHS9vmLXWAQ=
=4kJ3
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5703:01 Important: Red Hat Ansible Automation Platform 1.2

An update is now available for Red Hat Ansible Automation Platform 1.2 Red Hat Product Security has rated this update as having a security impact of Important

Summary

Red Hat Ansible Automation Platform integrates Red Hat’s automation suite consisting of Red Hat Ansible Tower, Red Hat Ansible Engine, and use-case specific capabilities for Microsoft Windows,network, security, and more, along with Software-as-a-Service (SaaS)-based capabilities and features for organization-wide effectiveness.
Security Fix(es):
* python3-django: Django: SQL injection in QuerySet.annotate(),aggregate() and extra() (CVE-2022-28346)
* python3-django: Django: SQL injection via QuerySet.explain(options) on PostgreSQL (CVE-2022-28347)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-28346 https://access.redhat.com/security/cve/CVE-2022-28347 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Automation Hub 4.2 for RHEL 7:
Source: python3-django-2.2.28-1.el7pc.src.rpm
noarch: python3-django-2.2.28-1.el7pc.noarch.rpm
Red Hat Automation Hub 4.2 for RHEL 8:
Source: python3-django-2.2.28-1.el8pc.src.rpm
noarch: python3-django-2.2.28-1.el8pc.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5703-01
Product: Red Hat Ansible Automation Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5703
Issued Date: : 2022-07-25
CVE Names: CVE-2022-28346 CVE-2022-28347

Topic

An update is now available for Red Hat Ansible Automation Platform 1.2Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Automation Hub 4.2 for RHEL 7 - noarch

Red Hat Automation Hub 4.2 for RHEL 8 - noarch

Bugs Fixed

2072447 - CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()

2072459 - CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.