8.1
High
CVE-2024-1657 A flaw was found in the ansible automation platform
Description
A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions not published |
References
- RHSA-2024:1057 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2265085 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8
The 21 CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
9.9
Critical
CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1
Critical
CVE-2026-84502
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
9.9
Critical
CVE-2026-84474
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
9.9
Critical