Multiple vulnerabilities in Ansible Automation Platform 2.4 packages



Risk High
Patch available YES
Number of vulnerabilities 12
CVE-ID CVE-2024-42005
CVE-2024-41991
CVE-2024-41990
CVE-2024-33663
CVE-2024-32879
CVE-2024-41989
CVE-2024-39614
CVE-2024-39330
CVE-2024-39329
CVE-2024-38875
CVE-2024-7246
CVE-2024-5569
CWE-ID CWE-89
CWE-20
CWE-310
CWE-178
CWE-400
CWE-22
CWE-200
CWE-835
Exploitation vector Network
Public exploit Public exploit code for vulnerability #7 is available.
Vulnerable software
 python3x-pulpcore (Red Hat package)
Operating systems & Components / Operating system package or component

python3x-pulp-ansible (Red Hat package)
Operating systems & Components / Operating system package or component

python3x-jmespath (Red Hat package)
Operating systems & Components / Operating system package or component

python3x-gunicorn (Red Hat package)
Operating systems & Components / Operating system package or component

python3x-grpcio (Red Hat package)
Operating systems & Components / Operating system package or component

python3x-django (Red Hat package)
Operating systems & Components / Operating system package or component

python-zipp (Red Hat package)
Operating systems & Components / Operating system package or component

python-pulpcore (Red Hat package)
Operating systems & Components / Operating system package or component

python-pulp-ansible (Red Hat package)
Operating systems & Components / Operating system package or component

python-jmespath (Red Hat package)
Operating systems & Components / Operating system package or component

python-gunicorn (Red Hat package)
Operating systems & Components / Operating system package or component

python-grpcio (Red Hat package)
Operating systems & Components / Operating system package or component

python-django (Red Hat package)
Operating systems & Components / Operating system package or component

automation-controller (Red Hat package)
Operating systems & Components / Operating system package or component

Ansible Automation Platform
Server applications / Other server solutions

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 12 vulnerabilities.

1) SQL injection

EUVDB-ID: #VU95445

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-42005

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in QuerySet.values() and values_list() functions. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU95444

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-41991

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() and AdminURLFieldWidget. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU95443

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-41990

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cryptographic issues

EUVDB-ID: #VU91833

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-33663

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to algorithm confusion with OpenSSH ECDSA keys and other key formats. A remote attacker can perform MitM attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Handling of Case Sensitivity

EUVDB-ID: #VU89132

Risk: Medium

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-32879

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to default case-insensitive collation in MySQL or MariaDB databases. A remote user can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU95442

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-41989

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in django.utils.numberformat.floatformat() function. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU94188

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-39614

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in django.utils.translation.get_supported_language_variant() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Path traversal

EUVDB-ID: #VU94184

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-39330

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in django.core.files.storage.Storage.save() function. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU94183

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-39329

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the django.contrib.auth.backends.ModelBackend.authenticate() method. A remote attacker can enumerate users via a timing attack involving login requests for users with an unusable password.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU94182

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-38875

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in django.utils.html.urlize() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU96644

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-7246

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of HTTP/2 headers. A remote attacker can send a series of HTTP/2 requests to the application and gain access to sensitive information or perform spoofing attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Infinite loop

EUVDB-ID: #VU94792

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-5569

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker can pass a specially crafted zip file to the application, consume all available system resources and cause denial of service conditions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

python3x-pulpcore (Red Hat package): before 3.28.31-1.el8ap

python3x-pulp-ansible (Red Hat package): before 0.20.8-1.el8ap

python3x-jmespath (Red Hat package): before 0.10.0-5.el8ap

python3x-gunicorn (Red Hat package): before 22.0.0-2.el8ap

python3x-grpcio (Red Hat package): before 1.58.3-1.el8ap

python3x-django (Red Hat package): before 4.2.15-1.el8ap

python-zipp (Red Hat package): before 3.19.2-1.el9ap

python-pulpcore (Red Hat package): before 3.28.31-1.el9ap

python-pulp-ansible (Red Hat package): before 0.20.8-1.el9ap

python-jmespath (Red Hat package): before 0.10.0-5.el9ap

python-gunicorn (Red Hat package): before 22.0.0-2.el9ap

python-grpcio (Red Hat package): before 1.58.3-1.el9ap

python-django (Red Hat package): before 4.2.15-1.el9ap

automation-controller (Red Hat package): before 4.5.10-1.el8ap

Ansible Automation Platform: before 2.4

CPE2.3 External links

https://access.redhat.com/errata/RHSA-2024:6428


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###