RHSA-2023:4693MediumCVSS 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Published
August 21, 2023
Last Modified
August 19, 2026

🔗 CVE IDs covered (4)

CVE-2023-4380 →CVE-2023-23931 →CVE-2023-32681 →CVE-2023-36053 →

📋 Description

CVE-2023-4380 — platform: token exposed at importing project CVE-2023-23931 — python-cryptography: memory corruption via immutable objects CVE-2023-32681 — python-requests: Unintended leak of Proxy-Authorization header CVE-2023-36053 — python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

🎯 Affected products48

  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • automation-eda-controller-0:1.0.1-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • automation-eda-controller-0:1.0.1-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • automation-eda-controller-0:1.0.1-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • automation-eda-controller-0:1.0.1-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • automation-eda-controller-server-0:1.0.1-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • automation-eda-controller-server-0:1.0.1-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • automation-eda-controller-ui-0:1.0.1-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • automation-eda-controller-ui-0:1.0.1-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-cryptography-0:38.0.4-2.el9ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-cryptography-debugsource-0:38.0.4-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-cryptography-debugsource-0:38.0.4-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-cryptography-debugsource-0:38.0.4-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-cryptography-debugsource-0:38.0.4-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-django-0:3.2.20-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-requests-0:2.31.0-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python-rsa-0:4.7.2-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-0:38.0.4-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-0:38.0.4-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-0:38.0.4-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-0:38.0.4-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-debuginfo-0:38.0.4-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-debuginfo-0:38.0.4-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-debuginfo-0:38.0.4-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-cryptography-debuginfo-0:38.0.4-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-django-0:3.2.20-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-requests-0:2.31.0-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python3-rsa-0:4.7.2-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • python39-cryptography-0:38.0.4-2.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • +18 more not shown

✅ Remediation

Red Hat Ansible Automation Platform Workaround: For users who are not able to update Requests immediately, there is one potential workaround. You may disable redirects by setting allow_redirects to False on all calls through Requests top-level APIs. Note that if you are currently relying on redirect behaviors, you will need to capture the 3xx response codes and ensure a new request is made to the redirect destination. import requests r = requests.get('http://github.com/', allow_redirects=False)

🔗 References (7)