Red Hat Ansible Automation Platform 2.0

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.

Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

Platform: ec2_key module prints out the private key directly to the standard output

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges.

Hub: insecure galaxy-importer tarfile extraction

An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.

Controller: cross site scripting in automation controller ui

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

Aap: aap-gateway: automation-hub: sensitive information disclosure

Aap: sensitive cookie(s) set without security flags