Threats Tagged 'cve-2024-11079'

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core (CVE-2024-11079) * automation-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5 (CVE-2024-11483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform UI * Added support for filtering job templates, jobs, and inventories by labels (AAP-36540) * Fixed an issue where it was not possible to open a job template after removing the user which created the template (AAP-35820) * Fixed an issue where the inventory source update failed, and did not allow selection of the inventory file (AAP-35246) * Fixed an issue where the Login Redirect Override setting was missing and not functioning as expected (AAP-33295) * Disabled auto complete for secret credential fields (AAP-33188) * Fixed an issue where users were able to select a credential that required a password when defining a schedule (AAP-32821) * Fixed the navigation Team -> roles -> eda to the created team role page, where it did not work after adding a new team role.(AAP-31873) * When configuring an Ansible Remote to sync collections from other servers, a requirements file is only required for syncs from Galaxy, and optional otherwise. Without a requirements file, all collections get synced (AAP-31238) * Fixed an issue where the job output did not show unless you switched tabs (AAP-31125) * Fixed an issue where the bulk removal of selected role permissions disappeared when more than 4 permissions were selected (AAP-28030) Event-Driven Ansible * Fixed an issue where the project sync would not fail on an empty or unstructured git repository (AAP-35777) * Fixed an issue in the collection where the activation module failed with a misleading error message if the rulebook, project, decision environment, or organization could not be found (AAP-35360) * Fixed an issue where rulebook validation import/sync fails when a rulebook has a duplicated rule name (AAP-35164) * Added validation that a host specified as part of a container registry credential conforms to container registry standards (AAP-34969) * Fixed an issue where the Event Driven Ansible API allowed a credential’s type to be changed (AAP-34968) * Fixed an issue where a previously failed project could be accidentally changed to completed after a resync (AAP-34744) * Fixed an issue where no message was recorded when a project did not contain any rulebooks (AAP-34555) * Fixed an issue whereby multiple Red Hat Ansible Automation Platform credentials were being attached to activations (AAP-34025) * Fixed an issue where the url field of the event stream was not updated if EDA_EVENT_STREAM_BASE_URL setting changed (AAP-33819) * Extended the scope of the log_level and debug settings (AAP-33669) * Fixed an issue where there was an erroneous dependency on the existence of an organization named Default (AAP-33551) * A project can now be synced with the Event Driven Ansible collection modules (AAP-32264) * Fixed an issue where occasionally an activation is reported as running, before it is ready to receive events (AAP-31225) * Fixed an issue where Enabled options had its own scrollbar on the Rulebook Activation Details page (AAP-31130) * Added 'purge_log_records' to aap-eda-manage to clean up outdated database records (AAP-30684) * Fixed an issue where the status of an activation was occasionally inconsistent with the status of the latest instance after a restart (AAP-29755) * Fixed an issue where the user could not edit auto-generated injector vars while creating Event Driven Ansible custom credentials (AAP-29752) * Fixed an issue where importing a project from a non-existing branch resulted in the completed state instead of a Failed status (AAP-29144) * Fixed an issue where in some cases the file_watch source plugin in an Event Driven Ansible collection raised the QueueFull exception (AAP-29139) * In the Rulebook activation create form, selecting a project is now required before selecting a rulebook (AAP-28082) * The Create Credentials button is now visible irrespective of whether there are any existing credentials or not (AAP-23707) * automation-eda-controller has been updated to 1.1.3 * ansible-rulebook has been updated to 1.1.2 Container-based Ansible Automation Platform * Fixed an issue that allowed Automation controll

A moderate severity vulnerability (CVE-2024-11079) in Red Hat Ansible Automation Platform's ansible-core component allows an unsafe tagging bypass via the hostvars object. This issue affects multiple ansible-core versions used in the Execution Environments containers. Red Hat has released updated ansible-core versions in the 2.15, 2.16, 2.17, and 2.18 streams to address this vulnerability. The advisory recommends updating to these fixed versions to mitigate the risk.

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.