Threats tagged 'ghsa-5vrq-6q93-m3rf'

A vulnerability in Ansible Automation Platform's automation-controller allows a privileged user to achieve arbitrary code execution inside the execution-environment container. This occurs because the custom Credential Type environment-variable injector uses a deny-list that fails to block certain process-hijacking loader variables such as BASH_ENV, enabling an attacker to inject malicious scripts. A fix is available from Red Hat for Ansible Automation Platform 2.6.