This advisory covers three security vulnerabilities in Red Hat Ansible Automation Platform 2.4's automation-controller: CVE-2024-21520 is a cross-site scripting (XSS) vulnerability via break_long_headers in djangorestframework; CVE-2024-41810 is a reflected XSS via HTML injection in redirect responses in twisted; CVE-2024-37891 involves urllib3 not stripping the proxy-authorization request header during cross-origin redirects. These issues could allow an attacker to execute malicious scripts or leak sensitive headers under certain conditions. Red Hat has released automation-controller version 4.5.12 with fixes for these vulnerabilities.

The vulnerabilities could allow attackers to perform cross-site scripting attacks or leak proxy-authorization headers during redirects, potentially leading to unauthorized script execution or sensitive information disclosure within the affected Ansible Automation Platform environment. The overall security impact is rated moderate by Red Hat. There are no reports of known exploits in the wild at this time.

Red Hat has provided an official fix by releasing automation-controller version 4.5.12 which addresses these vulnerabilities. Users of Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 9 should update to this version to remediate the issues. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are indicated beyond applying the update.