-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Advisory ID:       RHSA-2023:4693-01
Product:           Red Hat Ansible Automation Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4693
Issue date:        2023-08-21
CVE Names:         CVE-2023-4380 CVE-2023-23931 CVE-2023-32681 
                   CVE-2023-36053 
=====================================================================

1. Summary:

An update is now available for Red Hat Ansible Automation Platform 2.4

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Ansible Automation Platform 2.4 for RHEL 8 - aarch64, noarch, ppc64le, s390x, x86_64
Red Hat Ansible Automation Platform 2.4 for RHEL 9 - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

Red Hat Ansible Automation Platform provides an enterprise framework for
building, deploying and managing IT automation at scale. IT Managers can
provide top-down guidelines on how automation is applied to individual
teams, while automation developers retain the freedom to write tasks that
leverage existing knowledge without the overhead. Ansible Automation
Platform makes it possible for users across an organization to share, vet,
and manage automation content by means of a simple, powerful, and agentless
language.

Security Fix(es):
* automation-eda-controller: token exposed at importing project
(CVE-2023-4380)
* python3-cryptography/python39-cryptography: memory corruption via
immutable objects (CVE-2023-23931)
* python3-django/python39-django: Potential regular expression denial of
service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)
* python3-requests/python39-requests: Unintended leak of
Proxy-Authorization header (CVE-2023-32681)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional changes for Event-Driven Ansible:
* automation-eda-controller has been updated to 1.0.1
* Fixed Contributor and editor roles cannot set the AWX token (AAP-11573)
* Onboarding journey wizard does not request a controller token creation
(AAP-11907)
* Wrong count of “restarts” field (AAP-12042)
* Filtering on any list only works for items in view (AAP-12446)
* Missing audit records in a running activations with many firings
(AAP-12522)
* When a job template fails the event payload is missing key attributes
(AAP-12529)
* Fix a git token leak when the import project fails. (AAP-12767)
* Restart policy in k8s doesn’t restart successful activations that are
marked as failed (AAP-12862)
* Inconsistent status when disabling/enabling activations (AAP-12896)
* run_job_template action fails and the rule is not counted as fired
(AAP-12909)
* Bulk deletion on rulebook activation list is not consistent (AAP-13093)
* Rulebook Activation link is not functioning in Rule Audit Detail Screen
(AAP-13182)
* Previously project credentials couldn't be updated if there was a change
to the credential used in the project, now credentials can be updated in a
project with a new or different credential. (AAP-13983)

4. Solution:

Red Hat Ansible Automation Platform

5. Bugs fixed (https://bugzilla.redhat.com/):

2171817 - CVE-2023-23931 python-cryptography: memory corruption via immutable objects
2209469 - CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
2232324 - CVE-2023-4380 Ansible: token exposed at importing project

6. Package List:

Red Hat Ansible Automation Platform 2.4 for RHEL 8:

Source:
automation-eda-controller-1.0.1-1.el8ap.src.rpm
python3x-cryptography-38.0.4-2.el8ap.src.rpm
python3x-django-3.2.20-1.el8ap.src.rpm
python3x-requests-2.31.0-1.el8ap.src.rpm
python3x-rsa-4.7.2-1.el8ap.src.rpm

aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm

noarch:
automation-eda-controller-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el8ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el8ap.noarch.rpm
python39-django-3.2.20-1.el8ap.noarch.rpm
python39-requests-2.31.0-1.el8ap.noarch.rpm
python39-rsa-4.7.2-1.el8ap.noarch.rpm

ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm

s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm

x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm

Red Hat Ansible Automation Platform 2.4 for RHEL 8:

Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm

aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm

ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm

s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm

x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm

Red Hat Ansible Automation Platform 2.4 for RHEL 8:

Source:
python3x-cryptography-38.0.4-2.el8ap.src.rpm

aarch64:
python39-cryptography-38.0.4-2.el8ap.aarch64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.aarch64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.aarch64.rpm

ppc64le:
python39-cryptography-38.0.4-2.el8ap.ppc64le.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.ppc64le.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.ppc64le.rpm

s390x:
python39-cryptography-38.0.4-2.el8ap.s390x.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.s390x.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.s390x.rpm

x86_64:
python39-cryptography-38.0.4-2.el8ap.x86_64.rpm
python39-cryptography-debuginfo-38.0.4-2.el8ap.x86_64.rpm
python3x-cryptography-debugsource-38.0.4-2.el8ap.x86_64.rpm

Red Hat Ansible Automation Platform 2.4 for RHEL 9:

Source:
automation-eda-controller-1.0.1-1.el9ap.src.rpm
python-cryptography-38.0.4-2.el9ap.src.rpm
python-django-3.2.20-1.el9ap.src.rpm
python-requests-2.31.0-1.el9ap.src.rpm
python-rsa-4.7.2-1.el9ap.src.rpm

aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm

noarch:
automation-eda-controller-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-server-1.0.1-1.el9ap.noarch.rpm
automation-eda-controller-ui-1.0.1-1.el9ap.noarch.rpm
python3-django-3.2.20-1.el9ap.noarch.rpm
python3-requests-2.31.0-1.el9ap.noarch.rpm
python3-rsa-4.7.2-1.el9ap.noarch.rpm

ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm

s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm

x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm

Red Hat Ansible Automation Platform 2.4 for RHEL 9:

Source:
python-cryptography-38.0.4-2.el9ap.src.rpm

aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm

ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm

s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm

x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm

Red Hat Ansible Automation Platform 2.4 for RHEL 9:

Source:
python-cryptography-38.0.4-2.el9ap.src.rpm

aarch64:
python-cryptography-debugsource-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-38.0.4-2.el9ap.aarch64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.aarch64.rpm

ppc64le:
python-cryptography-debugsource-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-38.0.4-2.el9ap.ppc64le.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.ppc64le.rpm

s390x:
python-cryptography-debugsource-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-38.0.4-2.el9ap.s390x.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.s390x.rpm

x86_64:
python-cryptography-debugsource-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-38.0.4-2.el9ap.x86_64.rpm
python3-cryptography-debuginfo-38.0.4-2.el9ap.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-4380
https://access.redhat.com/security/cve/CVE-2023-23931
https://access.redhat.com/security/cve/CVE-2023-32681
https://access.redhat.com/security/cve/CVE-2023-36053
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJk5BtDAAoJENzjgjWX9erEeOAP/2mxhopEMcT5/vUYAjm1Mx06
VbSNRev5unwCqqHN2C29xS2JNv0+sazo7JcVIP/2qICLEIBTBxPxGkbmeU5z7KGX
pSbhz2WFonv0YaTZ3qHrsk5poaT8K2lY2z4FXjW/qSuAe5EvKkFbD/22Jy+Im7to
0mz618G4QNkbnYU39YVeyI2f+GB0S3eqDof0LANb0BTjJRga/ENnbBBE3/ERBdMD
xiHfnyTwaQhtFZgml3g+RXhLWZSHblS2IRbwLHlYA5l8pJgMASgcPHzXRFOZimYr
4/uLFylKr20NJdrjRCJ5sAvOPGaOup7w9jAyrdpturH6fyY3hUoYVuGJJc7dLSu1
6gcz35pxWIVdAFycvamkblWaLrRPKW4f8o6+a9dorEcH98gS4a75mI+LROLyVlr4
jGjVeRrCBY1QBZjD+2duYCw/JoHCncy+uNCVouxpllHhEeq/lw6xmGz8qTx80fnB
SZvluOYS6jY1pW+9KZ6ndohuN0mPT4sJogkytCRpurDR2B9P+H7ZTWl+1X7P+oj3
C8NEG9TUmsnFlfM3HsJu+XQqZAEwYdOen1qZXGJwyRJjqi2+81Xe6MQaQsYiRyfU
SJHZdsYH0dWP2KeVL1laNfZ+AwzrTNnq09ux0vCcZwaiiK4DtwRveMcFNiL3bF23
EAHghshuHJQsa1nZLp7E
=iLN7
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce