Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84719 | corrigé en 0:4.5.36-1.el9ap | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instanc… | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-75884 | corrigé en 0:4.5.36-1.el9ap | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-84502 | corrigé en 0:4.5.36-1.el9ap | Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --u… | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-84474 | corrigé en 0:4.5.36-1.el9ap | Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_… | CRITICAL 9.9 | 0.8 % | ||
| CVE-2026-12564 | corrigé en 0:4.5.36-1.el9ap | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf | CRITICAL 9.6 | 0.3 % | ||
| CVE-2025-2877 | corrigé en 0:1.0.8-2.el9ap | Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-9902 | | Ansible-core: ansible-core user may read/write unauthorized content | MEDIUM 6.3 | 0.3 % | ||
| CVE-2024-8775 | | Ansible-core: exposure of sensitive information in ansible vault files due to improper logging | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-6840 | corrigé en 0:4.5.10-1.el9ap | Automation-controller: gain access to the k8s api server via job execution with container group | MEDIUM 6.6 | 0.4 % | ||
| CVE-2024-1657 | corrigé en 0:2.4-6.el9ap | Platform: insecure websocket used when interacting with eda server | HIGH 8.1 | 0.4 % | ||
| CVE-2024-1394 | corrigé en 0:1.4.5-1.el9ap | Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads | HIGH 7.5 | 1.5 % | ||
| CVE-2024-0690 | corrigé en 1:2.15.9-1.el9ap | Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-5115 | corrigé en 0:2.15.5-1.el9ap | Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files | MEDIUM 6.3 | 1.0 % | ||
| CVE-2023-5764 | corrigé en 1:2.15.8-1.el9ap | Ansible: template injection | HIGH 7.8 | 0.5 % | ||
| CVE-2023-5189 | corrigé en 0:0.4.18-1.el9ap | Hub: insecure galaxy-importer tarfile extraction | MEDIUM 6.5 | 1.0 % | ||
| CVE-2023-3971 | corrigé en 0:4.4.1-1.el9ap | Controller: html injection in custom login info | HIGH 7.3 | 0.8 % | ||
| CVE-2023-4380 | corrigé en 0:1.0.1-1.el9ap | Platform: token exposed at importing project | MEDIUM 6.3 | 0.6 % | ||
| CVE-2023-4237 | | Platform: ec2_key module prints out the private key directly to the standard output | HIGH 7.8 | 0.3 % |