Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4

Published: 2024-01-23

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-41040 CVE-2023-46137
CWE-ID	CWE-22 CWE-444
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Ansible Automation Platform Server applications / Other server solutions python3x-twisted (Red Hat package) Operating systems & Components / Operating system package or component python3x-gitpython (Red Hat package) Operating systems & Components / Operating system package or component python3x-dynaconf (Red Hat package) Operating systems & Components / Operating system package or component python-twisted (Red Hat package) Operating systems & Components / Operating system package or component python-gitpython (Red Hat package) Operating systems & Components / Operating system package or component python-dynaconf (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU81056

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-41040

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when reading from the ".git" directory. A remote attacker can prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read these files from the local system. This can result in checking for existence of a specific files on the system or perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Ansible Automation Platform: 2.4

python3x-twisted (Red Hat package): before 23.10.0-1.el8ap

python3x-gitpython (Red Hat package): before 3.1.40-1.el8ap

python3x-dynaconf (Red Hat package): before 3.1.12-2.el8ap

python-twisted (Red Hat package): before 23.10.0-1.el9ap

python-gitpython (Red Hat package): before 3.1.40-1.el9ap

python-dynaconf (Red Hat package): before 3.1.12-2.el9ap

External links

http://access.redhat.com/errata/RHSA-2024:0322

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU82547

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46137

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')