RedHat: RHSA-2023-4693:01 Moderate: Red Hat Ansible Automation Platform 2.4
Summary
Red Hat Ansible Automation Platform provides an enterprise framework for
building, deploying and managing IT automation at scale. IT Managers can
provide top-down guidelines on how automation is applied to individual
teams, while automation developers retain the freedom to write tasks that
leverage existing knowledge without the overhead. Ansible Automation
Platform makes it possible for users across an organization to share, vet,
and manage automation content by means of a simple, powerful, and agentless
language.
Security Fix(es):
* automation-eda-controller: token exposed at importing project
(CVE-2023-4380)
* python3-cryptography/python39-cryptography: memory corruption via
immutable objects (CVE-2023-23931)
* python3-django/python39-django: Potential regular expression denial of
service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)
* python3-requests/python39-requests: Unintended leak of
Proxy-Authorization header (CVE-2023-32681)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional changes for Event-Driven Ansible:
* automation-eda-controller has been updated to 1.0.1
* Fixed Contributor and editor roles cannot set the AWX token (AAP-11573)
* Onboarding journey wizard does not request a controller token creation
(AAP-11907)
* Wrong count of ârestartsâ field (AAP-12042)
* Filtering on any list only works for items in view (AAP-12446)
* Missing audit records in a running activations with many firings
(AAP-12522)
* When a job template fails the event payload is missing key attributes
(AAP-12529)
* Fix a git token leak when the import project fails. (AAP-12767)
* Restart policy in k8s doesnât restart successful activations that are
marked as failed (AAP-12862)
* Inconsistent status when disabling/enabling activations (AAP-12896)
* run_job_template action fails and the rule is not counted as fired
(AAP-12909)
* Bulk deletion on rulebook activation list is not consistent (AAP-13093)
* Rulebook Activation link is not functioning in Rule Audit Detail Screen
(AAP-13182)
* Previously project credentials couldn't be updated if there was a change
to the credential used in the project, now credentials can be updated in a
project with a new or different credential. (AAP-13983)
Summary
Solution
Red Hat Ansible Automation Platform
References
https://access.redhat.com/security/cve/CVE-2023-4380 https://access.redhat.com/security/cve/CVE-2023-23931 https://access.redhat.com/security/cve/CVE-2023-32681 https://access.redhat.com/security/cve/CVE-2023-36053 https://access.redhat.com/security/updates/classification/#moderate
Package List
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
automation-eda-controller-1.0.1-1.el8ap.src.rpm
python3x-cryptography-38.0.4-2.el8ap.src.rpm
python3x-django-3.2.20-1.el8ap.src.rpm
python3x-requests-2.31.0-1.el8ap.src.rpm
python3x-rsa-4.7.2-1.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
noarch:
automation-eda-controller-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el8ap.noarch.rpm
python39-django-3.2.20-1.el8ap.noarch.rpm
python39-requests-2.31.0-1.el8ap.noarch.rpm
python39-rsa-4.7.2-1.el8ap.noarch.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 8:
Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm
aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm
ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm
s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm
x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
automation-eda-controller-1.0.1-1.el9ap.src.rpm
python-cryptography-38.0.4-2.el9ap.src.rpm
python-django-3.2.20-1.el9ap.src.rpm
python-requests-2.31.0-1.el9ap.src.rpm
python-rsa-4.7.2-1.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
noarch:
automation-eda-controller-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el9ap.noarch.rpm
python3-django-3.2.20-1.el9ap.noarch.rpm
python3-requests-2.31.0-1.el9ap.noarch.rpm
python3-rsa-4.7.2-1.el9ap.noarch.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
python-cryptography-38.0.4-2.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
Red Hat Ansible Automation Platform 2.4 for RHEL 9:
Source:
python-cryptography-38.0.4-2.el9ap.src.rpm
aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm
ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm
s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm
x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
![Dist Redhat](/images/distros/dist-redhat.png)
Topic
An update is now available for Red Hat Ansible Automation Platform 2.4Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat Ansible Automation Platform 2.4 for RHEL 8 - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Ansible Automation Platform 2.4 for RHEL 9 - aarch64, noarch, ppc64le, s390x, x86_64
Bugs Fixed
2171817 - CVE-2023-23931 python-cryptography: memory corruption via immutable objects
2209469 - CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
2232324 - CVE-2023-4380 Ansible: token exposed at importing project