The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1057 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-eda-controller / ansible-rulebook / ansible-automation-platform-installer: Insecure websocket     used when interacting with EDA server (CVE-2024-1657)

    * python3-django/python39-django: denial-of-service in 'intcomma' template filter (CVE-2024-24680)

    * python3-jinja2/python39-jinja2: HTML attribute injection when passing user input as keys to xmlattr     filter (CVE-2024-22195)

    * python3-aiohttp/python39-aiohttp: CRLF injection if user controls the HTTP method using aiohttp client     (CVE-2023-49082)

    * python3-aiohttp/python39-aiohttp: HTTP request modification (CVE-2023-49081)

    * python3-aiohttp/python39-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)

    * python3-pycryptodomex/python39-pycryptodomex: side-channel leakage for OAEP decryption in PyCryptodome     and pycryptodomex (CVE-2023-52323)

    * python3-pillow/python39-pillow: uncontrolled resource consumption when textlength in an ImageDraw     instance operates on a long text argument (CVE-2023-44271)

    * python3-pygments/python39-pygments: ReDoS in pygments (CVE-2022-40896)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * automation-controller has been updated to 4.5.2
    * Enabled HashiCorp Vault LDAP and Userpass authentication (AAP-19842)

    Updates and fixes for automation hub:
    * automation-hub and python3-galaxy-ng/python39-galaxy-ng have been updated to 4.9.1
    * various dependencies have been updated

    Updates and fixes for Event-Driven Ansible:
    * automation-eda-controller has been updated to 1.0.5
    * various dependencies have been updated
    * Fixed a vulnerability that allowed command line injections in user and url fields for projects     (AAP-17778)
    * The communication between the activations and eda-server is now authenticated. Once EDA Controller is     upgraded, all the existing running activations must be restarted with upgraded Decision Environment images     (AAP-17619)
    * Removed 409 conflict error when enabling an activation (AAP-16305)
    * An activation status did not change to failed when an internal error occurred (AAP-16014)
    * Restarting the EDA server can cause activation states to become stale (AAP-13064)
    * RHEL 9.2 activations can not connect to the host (AAP-12929)
    * Added podman_containers_conf_logs_max_size variable to control max log size for podman installations     with a default value of 10 MiB (AAP-12295)

    Note: The 2.4-6 installer/setup should be used to update Event-Driven Ansible to 1.0.5

    Updates and fixes for installer and setup:
    * Added podman_containers_conf_logs_max_size variable for containers.conf to control max log size for     podman installations with a default value of 10 MiB (AAP-19775)
    * EDA debug flag of false will now correctly disable django debug mode (AAP-19577)
    * installer and setup have been updated to 2.4-6

    Additional changes:
    * ansible-builder has been updated to 3.0.1
    * ansible-runner has been updated to 2.3.5
    * ansible-dev-tools has been added

    For more details about the updates and fixes included in this release, refer to the Release Notes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモート Redhat Enterprise Linux 8 / 9 ホストに、RHSA-2024:1057 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - pygments: pygments での ReDoS (CVE-2022-40896)

  - python-pillow: ImageDraw インスタンスの textlength が長いテキスト引数で動作するときの制御されないリソース消費 (CVE-2023-44271)

  - python-aiohttp: ヘッダー解析に関する HTTP パーサーにおける多数の問題 (CVE-2023-47627)

  - aiohttp: HTTP リクエストの変更 (CVE-2023-49081)

  - aiohttp: ユーザーが aiohttp クライアントを使用して HTTP メソッドをコントロールする場合の CRLF インジェクション (CVE-2023-49082)

  - pycryptodome: PyCryptodome および pycryptodomex における OAEP 復号化のサイドチャネル漏洩 (CVE-2023-52323)

  - ansible 自動化プラットフォーム: EDA サーバーとのやり取りの際に使用される安全でない websocket (CVE-2024-1657)

  - jinja2: ユーザー入力を xmlattr フィルターへのキーとして渡す際の HTML 属性インジェクション (CVE-2024-22195)

  - Django: 「intcomma」テンプレートフィルターでのサービス拒否 (CVE-2024-24680)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Redhat Enterprise Linux 8/9 主機上安裝的多個套件受到 RHSA-2024:1057 公告中提及的多個弱點影響。

  - pygments：pygments 中的 ReDoS (CVE-2022-40896)

  - python-pillow：在長文字引數中使用 ImageDraw 執行個體中的 textlength 時，存在資源消耗不受控制弱點 (CVE-2023-44271)

  - python-aiohttp：具有標頭剖析功能的 HTTP 剖析器中有多個問題 (CVE-2023-47627)

  - aiohttp：HTTP 要求修改 (CVE-2023-49081)

  - aiohttp：若使用者使用 aiohttp 用戶端控制 HTTP 方法，則會發生 CRLF 插入攻擊 (CVE-2023-49082)

  - pycryptodome：PyCryptodome 和 pycryptodomex 的 OAEP 解密中存在側通道洩漏弱點 (CVE-2023-52323)

  - ansible automation platform：與 EDA 伺服器互動時使用不安全的 websocket (CVE-2024-1657)

  - jinja2：將使用者輸入作為金鑰傳遞至 xmlattr 篩選器時，發生 HTML 屬性插入攻擊 (CVE-2024-22195)

  - Django：``intcomma`` 範本篩選器中存在拒絕服務弱點 (CVE-2024-24680)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 8 / 9 主机上安装的多个程序包受到 RHSA-2024:1057 公告中提及的多个漏洞影响。

  - pygments：pygments 中的 ReDoS (CVE-2022-40896)

  - python-pillow：当 ImageDraw 实例中的 textlength 在长文本参数上运行时，不受控制的资源消耗 (CVE-2023-44271)

  - python-aiohttp：HTTP 解析器中的多个标头解析问题 (CVE-2023-47627)

  - aiohttp：HTTP 请求修改 (CVE-2023-49081)

  - aiohttp：如果用户控制使用 aiohttp 客户端的 HTTP 方法，则发生 CRLF 注入 (CVE-2023-49082)

  - pycryptodome：PyCryptodome 和 pycryptodomex 中 OAEP 解密的边信道泄漏 (CVE-2023-52323)

  - ansible automation platform：与 EDA 服务器交互时使用了不安全的 websocket (CVE-2024-1657)

  - jinja2：将用户输入作为密钥传递至 xmlattr 过滤器时的 HTML 属性注入 (CVE-2024-22195)

  - Django：“intcomma”模板过滤器中的拒绝服务 (CVE-2024-24680)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
191748	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Important) (RHSA-2024:1057)	Nessus	Red Hat Local Security Checks	2024/3/8	2024/11/7	high
191748	RHEL 8/9：Red Hat Ansible Automation Platform 2.4 製品セキュリティおよびバグ修正プログラムの更新 (重要度高) (RHSA-2024:1057)	Nessus	Red Hat Local Security Checks	2024/3/8	2024/11/7	high
191748	RHEL 8/9：Red Hat Ansible Automation Platform 2.4 產品安全性和錯誤修正更新 (重要) (RHSA-2024:1057)	Nessus	Red Hat Local Security Checks	2024/3/8	2024/11/7	high
191748	RHEL 8 / 9：Red Hat Ansible Automation Platform 2.4 产品安全和缺陷修复更新（重要）(RHSA-2024:1057)	Nessus	Red Hat Local Security Checks	2024/3/8	2024/11/7	high

検出

プラグインの検索

high

high

high

high