Threats Tagged 'cve-2024-28102'

A vulnerability in the python-jwcrypto package used in Red Hat Enterprise Linux 9 allows a malicious JSON Web Encryption (JWE) token to cause a denial of service condition. This issue is tracked as CVE-2024-28102 and is categorized under CWE-400 (Uncontrolled Resource Consumption). Red Hat has released an updated python-jwcrypto package to address this vulnerability. The severity is assessed as medium based on the advisory. No known exploits are reported in the wild. Users of affected Red Hat Enterprise Linux 9 versions should apply the provided security update to remediate the issue.

Red Hat Ansible Automation Platform 2. 4 for RHEL 8 and 9 contains multiple security vulnerabilities including a denial of service caused by malicious JWE tokens (CVE-2024-28102), improper handling of keys with non-attribute characters in jinja2 (CVE-2024-34064), and certificate verification bypass in subsequent requests (CVE-2024-35195). Red Hat has released updates addressing these issues in automation-controller version 4. 5. 8 and related components. The update is rated as having moderate security impact. No known exploits in the wild have been reported. The vulnerabilities affect the automation-controller component of the platform, which is used to manage IT automation at scale.