Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform 2.4 has multiple security vulnerabilities including a denial of service caused by a malicious JWE token, acceptance of keys with non-attribute characters in jinja2, and improper certificate verification in requests. These issues have been addressed in updates to the automation-controller and related components. The update also includes several bug fixes and enhancements. The severity of these vulnerabilities is rated as moderate by Red Hat.
AI Analysis
Technical Summary
This advisory addresses three security vulnerabilities in Red Hat Ansible Automation Platform 2.4's automation-controller component: CVE-2024-28102 (a denial of service vulnerability triggered by malicious JWE tokens in jwcrypto), CVE-2024-34064 (jinja2 accepting keys containing non-attribute characters), and CVE-2024-35195 (requests library ignoring certificate verification on subsequent requests to the same host). The update to automation-controller version 4.5.8 and related packages fixes these issues along with other bug fixes. The vulnerabilities impact the platform's ability to securely process tokens, template keys, and verify certificates, potentially affecting automation reliability and security.
Potential Impact
The vulnerabilities can lead to denial of service conditions via malicious JWE tokens, potential security bypass due to improper key handling in jinja2 templates, and weakened TLS certificate verification in HTTP requests. These issues could disrupt automation workflows or expose the platform to security risks. Red Hat rates the overall security impact as moderate.
Mitigation Recommendations
Red Hat has released updates for Ansible Automation Platform 2.4, including automation-controller 4.5.8, ansible-core 2.15.12, and aap-metrics-utility 0.3.0, which address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. No additional mitigations beyond applying the vendor-provided patches are indicated.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform 2.4 has multiple security vulnerabilities including a denial of service caused by a malicious JWE token, acceptance of keys with non-attribute characters in jinja2, and improper certificate verification in requests. These issues have been addressed in updates to the automation-controller and related components. The update also includes several bug fixes and enhancements. The severity of these vulnerabilities is rated as moderate by Red Hat.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses three security vulnerabilities in Red Hat Ansible Automation Platform 2.4's automation-controller component: CVE-2024-28102 (a denial of service vulnerability triggered by malicious JWE tokens in jwcrypto), CVE-2024-34064 (jinja2 accepting keys containing non-attribute characters), and CVE-2024-35195 (requests library ignoring certificate verification on subsequent requests to the same host). The update to automation-controller version 4.5.8 and related packages fixes these issues along with other bug fixes. The vulnerabilities impact the platform's ability to securely process tokens, template keys, and verify certificates, potentially affecting automation reliability and security.
Potential Impact
The vulnerabilities can lead to denial of service conditions via malicious JWE tokens, potential security bypass due to improper key handling in jinja2 templates, and weakened TLS certificate verification in HTTP requests. These issues could disrupt automation workflows or expose the platform to security risks. Red Hat rates the overall security impact as moderate.
Mitigation Recommendations
Red Hat has released updates for Ansible Automation Platform 2.4, including automation-controller 4.5.8, ansible-core 2.15.12, and aap-metrics-utility 0.3.0, which address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. No additional mitigations beyond applying the vendor-provided patches are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:4522
- Cve Count
- 3
- Additional Cves
- ["CVE-2024-34064","CVE-2024-35195"]
Threat ID: 6a1f4ea1e29bf47b50088226
Added to database: 06/02/2026, 21:44:01 UTC
Last enriched: 08/11/2026, 20:28:16 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.