Security features bypass in Ansible - CVE-2024-11079

Vulnerability identifier: #VU101827

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-11079

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application allows to use hostvars object to reference and execute templated content. A remote user can bypass unsafe content protections and execute arbitrary code if remote data or module outputs are improperly templated within playbooks.

Ansible
IBM Fusion HCI
Ansible Automation Platform
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Guardium Data Security Center (GDSC)
Maximo Application Suite - IoT Component
IBM Security SOAR
aap-metrics-utility (Red Hat package)
python3.11-validators (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
python3.11-django-ansible-base (Red Hat package)
automation-gateway (Red Hat package)
ansible-core (Red Hat package)
python3.11-django-flags (Red Hat package)

Install updates from vendor's website.

Ansible - addressed in versions 2.15.13, 2.16.14, 2.17.7, 2.18.1
IBM Fusion HCI - update to 2.10.0
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Security SOAR - update to 51.0.10.0
aap-metrics-utility (Red Hat package) - addressed in versions 0.4.1-2.el8ap, 0.4.1-2.el9ap
python3.11-validators (Red Hat package) - addressed in versions 0.34.0-1.el8ap, 0.34.0-1.el9ap
ansible-rulebook (Red Hat package) - addressed in versions 1.1.2-1.el8ap, 1.1.2-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.1.3-1.el8ap, 1.1.3-1.el9ap
Ansible Automation Platform - update to 2.5
python3.11-django-ansible-base (Red Hat package) - addressed in versions 2.5.20241218-1.el8ap, 2.5.20241218-1.el9ap
automation-gateway (Red Hat package) - addressed in versions 2.5.20241218-1.el8ap, 2.5.20241218-1.el9ap
ansible-core (Red Hat package) - addressed in versions 2.16.14-1.el8ap, 2.16.14-1.el9ap
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.9
python3.11-django-flags (Red Hat package) - addressed in versions 5.0.13-1.el8ap, 5.0.13-1.el9ap
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7

• https://access.redhat.com/errata/RHSA-2024:10770
• https://access.redhat.com/errata/RHSA-2024:11145
• https://access.redhat.com/security/cve/CVE-2024-11079
• https://bugzilla.redhat.com/show_bug.cgi?id=2325171

• Security restrictinos bypass in Ansible
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in Ansible Automation Platform 2.5 packages
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Security SOAR