Threats Tagged 'cleanstart'

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-eda-controller: Template Injection via Git Branch and Refspec in EDA Projects (CVE-2025-49521) * automation-eda-controller: Authenticated Argument Injection in Git URL in EDA Project Creation (CVE-2025-49520) * automation-gateway-proxy: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * automation-gateway-proxy-openssl30: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * automation-gateway-proxy-openssl32: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) * receptor: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Updated API error messaging to be more helpful in the event a user logs in as the admin user via legacy auth on one component, then tries to do so via the other component (AAP-47541) * Fixed an issue where API records could be missing or duplicated across pages (AAP-47504) * Refactored V1RootView.get() and improve reverse lookup logic (AAP-47366) * Refactored process_statuses() method to reduce its cognitive complexity (AAP-47341) * Improved accuracy of openapi API docs and schema (AAP-46639) * Reduced the cognitive complexity of method migrate_resource() in migrate_service_data.py from 56 to <=15 (AAP-45822) * Reduced the cognitive complexity of the process_fields() method in serializers/preference.py file (AAP-45820) * Reduced the cognitive complexity of unique_fields_for_model() method to below 15 (AAP-45819) * Enable query filtering for fields user_ansible_id, team_ansible_id, and object_ansible_id on the role assignment API endpoints (AAP-45443) * The Survey form is displayed for a Worlflow visualizer Job template or Workflow Job template node with a survey enabled and no Prompt on Launch fields (AAP-47732) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-47668) * The API feature flags used to hide references to Policy as Code in the UI have been removed. All Policy as Code fields appear for all users at all times (AAP-47006) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-46813) * On the inventory source form, for a source type of 'VMware ESXi' the user will be able to select credentials of type 'VMware vCenter' (AAP-46784) * Fixed a bug when selecting the 'Comparison' field for Atrriibute trigger in the Authenticator Map form (AAP-46555) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-45834) * added an extra validation to handle incorrect user input in the variables field, as the API doesn't return an error for it (AAP-42563) * Fixed a bug that was causing the UI to throw an error when launching a workflow job template with both "Prompt on Launch" and "Survey" enabled (AAP-42303) * The Hosts links in the Resource Counts section of the overview page were fixed to redirect to the Hosts page (AAP-42288) * Allows role assignments using object_ansible_id in the role_user_assignment module (AAP-48042) * Improved documentation and examples related to object_id and object_ansible_id parameters in role_user_assignment module (AAP-48041) * Allows object_id field in role_user_assignment module to accept a list of items (AAP-47979) * Fixed an example task in ansible.platform.token module (AAP-47976) * Specify correct aap_* parameters in ansible.platform.token module (AAP-47975) * Improved documentation and examples for authenticator and authenticator_map modules (AAP-45982) * Updated documentation examples for the ansible.platform.settings module with tested tasks examples (AAP-45954) * Added a new section in the collection README describing how to authenticate to AAP from the playbook (AAP-45578) * Ensures that modules in the ansible.platform collection accepts AAP_* variable for authentication (AAP-45363) * Fixed ansible.platform.user not adding users to organizations (AAP-45248) * Allows running ansible.platform collection modules in check_mode (AAP-45246) * Ad

Submariner 0.17.6 enables direct networking between pods and services on different Kubernetes clusters that are on-premises or in the cloud. This advisory contains bug fixes and enhancements to the Submariner container images. Security fixes: * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868) * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

CVE-2025-0913 is a vulnerability in the Go standard library syscall package related to improper link resolution before file access. The os.OpenFile function behaved inconsistently between Unix and Windows when handling dangling symbolic links with the O_CREATE and O_EXCL flags. On Unix, it did not follow symlinks, but on Windows, it created a file at the symlink's nonexistent target location. The issue is now fixed so that OpenFile returns an error when both flags are set and the target path is a symlink.

EPSS 0.3%VulnerabilityGo standard library#cwe-59#microsoft-security-response-ceGermany+7

When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if `verify=True` is explicitly specified later. This occurs because the underlying connection is reused from the session's connection pool, causing the initial TLS verification setting to persist for the lifetime of the pooled connection. As a result, applications may unintentionally send requests without certificate verification, leading to potential man-in-the-middle attacks and compromised confidentiality or integrity. This behavior affects versions of `requests` prior to 2.32.0.

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.27. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2025:4206 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.[y]/html-single/updating_clusters/index#updating-cluster-cli.