This advisory covers three security vulnerabilities in Red Hat Ansible Automation Platform 2.4's automation-controller component: CVE-2024-21520 is a cross-site scripting (XSS) vulnerability via break_long_headers in djangorestframework; CVE-2024-41810 is a reflected XSS via HTML injection in redirect responses in twisted; CVE-2024-37891 involves the proxy-authorization request header not being stripped during cross-origin redirects in urllib3. Red Hat has released automation-controller version 4.5.12 to fix these issues. The update also addresses other bug fixes such as correct ordering of Galaxy credentials and analytics gathering failures. The advisory rates the security impact as moderate and provides no CVSS scores directly but references CVE pages for details.

The vulnerabilities allow cross-site scripting attacks and improper handling of proxy-authorization headers, which could lead to security issues such as unauthorized script execution in user browsers and potential leakage of sensitive proxy credentials during redirects. These issues affect the automation-controller component of Red Hat Ansible Automation Platform 2.4. Red Hat rates the overall security impact as moderate. There are no known exploits in the wild at the time of this advisory.

Red Hat has released an official fix in automation-controller version 4.5.12 that addresses these vulnerabilities. Users of Red Hat Ansible Automation Platform 2.4 should update to automation-controller 4.5.12 or later to remediate these issues. The vendor advisory provides detailed package information and update instructions. No additional mitigation steps are indicated beyond applying the official update.