Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Important

A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally, it can be used to make outbound network requests, resulting in server-side request forgery.

CWE-434 - Unrestricted Upload of File with Dangerous Type

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.

CWE-502 - Deserialization of Untrusted Data

A flaw was found in JWCrypto, a Python library for JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE tokens that use ZIP compression. While the input token size is limited, the decompressed output size is not validated, allowing an attacker to cause excessive memory consumption. This can lead to memory exhaustion on affected systems, resulting in a Denial of Service (DoS).

CWE-770 - Allocation of Resources Without Limits or Throttling

A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service (DoS) for the affected system.

CWE-770 - Allocation of Resources Without Limits or Throttling

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')