The vulnerability CVE-2024-52304 affects the aiohttp library used by the automation-controller in Red Hat Ansible Automation Platform 2.5. It involves incorrect parsing of chunk extensions in HTTP requests, leading to a request smuggling vulnerability. This could potentially allow an attacker to interfere with HTTP request processing. Red Hat has released an update to automation-controller version 4.6.3 that addresses this issue. The advisory also includes fixes for other bugs and improvements in the platform's components such as receptor and container-based deployment configurations. The security impact is rated moderate, and no known exploits have been reported.

The vulnerability allows for HTTP request smuggling due to improper parsing of chunk extensions in aiohttp within the automation-controller. This could affect the integrity of HTTP request handling in the platform. Red Hat rates the security impact as moderate. No known exploits in the wild have been reported, reducing immediate risk. The vulnerability could potentially be leveraged to bypass security controls or interfere with request processing if exploited.

Red Hat has released an official security update for Ansible Automation Platform 2.5 that includes a fix for CVE-2024-52304 by updating the automation-controller to version 4.6.3. Users should apply this update promptly to remediate the vulnerability. The advisory provides detailed update instructions and additional bug fixes. Since this is not a cloud service, remediation requires applying the vendor-provided patch. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the update.