This advisory covers four security vulnerabilities affecting Red Hat Ansible Automation Platform 2.4 and its components. CVE-2024-7143 involves incorrect RBAC permissions assigned in tasks creating objects within python3-pulpcore, potentially allowing unauthorized actions. CVE-2024-37891 addresses urllib3 not stripping proxy-authorization headers during cross-origin redirects, which could lead to unintended credential exposure. CVE-2024-24790 concerns unexpected behavior in Go net/netip Is methods for IPv4-mapped IPv6 addresses, and CVE-2024-24788 involves a malformed DNS message causing an infinite loop in Go net package. Red Hat has released updated packages including automation-controller 4.5.11 and component updates to python3-pulpcore, python3-urllib3, and receptor to fix these issues.

The vulnerabilities collectively impact confidentiality, integrity, and availability aspects of the platform. CVE-2024-7143 can lead to unauthorized privilege escalation due to improper RBAC permissions. CVE-2024-37891 may expose proxy-authorization credentials during redirects, risking credential leakage. CVE-2024-24790 and CVE-2024-24788 may cause unexpected behavior and denial of service (infinite loop) respectively, affecting system stability. The CVSS vector for CVE-2024-7143 indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality and integrity impact, and low availability impact, corresponding to a medium severity rating.

Red Hat has released official fixes for these vulnerabilities in Red Hat Ansible Automation Platform 2.4 and related components. Users should apply the updates including automation-controller 4.5.11, python3-pulpcore 3.28.32, python3-urllib3 1.26.20, and receptor 1.4.8-1.1 as provided in the Red Hat advisory RHSA-2024:6765. No additional mitigation steps are indicated beyond applying these updates.