Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.4066 Red Hat Ansible Automation Platform 2.2.0 Product Security Update 17 August 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat Ansible Automation Platform 2.2.0 Publisher: Red Hat Operating System: Red Hat Resolution: Patch/Upgrade CVE Names: CVE-2022-2568 Original Bulletin: https://access.redhat.com/errata/RHSA-2022:6079 Comment: CVSS (Max): 8.8 CVE-2022-2568 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVSS Source: Red Hat Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Ansible Automation Platform 2.2.0 Product Security Update Advisory ID: RHSA-2022:6079-01 Product: Red Hat Ansible Automation Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:6079 Issue date: 2022-08-16 CVE Names: CVE-2022-2568 ===================================================================== 1. Summary: An update is now available for Red Hat Ansible Automation Platform 2.2 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Ansible Automation Platform 2.2 for RHEL 8 - noarch Red Hat Ansible Automation Platform 2.2 for RHEL 9 - noarch 3. Description: Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation hub: Ansible: Logic flaw leads to privilege escalation (CVE-2022-2568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2108653 - CVE-2022-2568 Ansible: Logic flaw leads to privilage escalation 6. Package List: Red Hat Ansible Automation Platform 2.2 for RHEL 8: Source: python3x-galaxy-ng-4.5.0-4.el8ap.src.rpm noarch: python39-galaxy-ng-4.5.0-4.el8ap.noarch.rpm Red Hat Ansible Automation Platform 2.2 for RHEL 9: Source: python-galaxy-ng-4.5.0-4.el9ap.src.rpm noarch: python3-galaxy-ng-4.5.0-4.el9ap.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-2568 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYvvcudzjgjWX9erEAQhaNBAAhoOJXPMIykWVx3OANchJRJ1AtpO78fbr OmhT938VvjhjLe46hcrYPDlFzxeTPrbsGrAtGsCiZlo8LWmQtVNYLjG1wrL0362Z KLFrx6bmaEqosmPJ6IpONQomebrwH/2OFI+6V+U/glRT/Q/fVFWRlfeuh4btMdDY qvxcpnafLqYd2ZIvOQgZ8IoCviW6VbeCYfkdXAhaVCy8BX+q2dXcLb+wfIgQ6xRD JqKbskbw5mCF+zkrl/fnBu6Y3b/BLY7VNQ1X3biFil9TWUMMaPWL3hFiabpM+U4P heHnId1h2Mv9rBtOxwYKnp9P9jmXjyARLIiRDYoUMcxIG/WTzr1LIwKW7UAFOEjD y1/LOLe8TsgIrsisrfuCFnK0l/04jwaViKcKuJD5hurnGeFeIG4pWyDPk9fDbLY7 XXlLxZIxq147gk1knhxLgZF64hM6BMuAFRW5eVP7KJtN89OTZe/cDSIw7+jBuW63 IuPoRDLD6+9FDLFu+lDQusZdysx4+GRxutsbvKYvYSyhD9zi2GQL9soDQUT7P+wf nRPvWN/2NWaIu3h8vfBdhO3zWTyfDSJq+xQwYpN1lPfTman9cC6XI+aVZU4W9YQy sFhaEofylPpkrXjV+Z4ryPHOIq2ppCfjJ7ourjH5VJSpHfVd2+JVzL+1vZFOcawN 74OeazUqo8o= =kUNg - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYvxEv8kNZI30y1K9AQi0Dg/+MXmNC4MU0HM7AAGgfvci1gDwaPyK5GSx p6OFweSvhF948A/Ie9Zp5eo0BM0/bTWYkxvhCNBPAdGW4PiBgQ2/1N7DG4FqcY+L E/b+1LQCHbu/qhKgtOwOfeCt3RdXu7rbQEnoJqYPrueW2Ls9pCNDQxj3Wfc+EPB8 z0JbJikvMcMvY5E0jPX6QGsPsTp3+PCwgTFC/oJ83bJtmnmUHy+0v6Vb+Gya1L1I O/QJgndMh1Ckju3RuYfGdnUIv+zJ62dx49OKZLfj9P/kOQcpC5tYxoM7UIMPeXac hbuUMqyzc8HCMluP4zRAq2qsJ7ZX4qQcRHcUEZ2Lac7g/BlxDMRB+zs2Zmo2vhvD JIUporVDrrBJJvwXD3ea54DHIpJbE5C5d5xffsddLRKpoV3KaFedp1qLGQ7Rd3zC SUy5Y9cGmRow9qksMUYcdW4YCYkP6bonzl2venHXopwhU6d+XVUDzNUavLerpzKJ bPul+3lh9l8VEEMZSodKD1VrQaHxgGfeB9HJCPxy7pU4SxFeBarq0gEChpfgn9Oo EnfHeTksrZeBMUaes6N7ff4lM4Vt+HRmZDnekkROdiMMFf/c561O8wdnV+Veg6Rg EfanYSDpiEtbH/ZyenW1JQUEfY1xIGhM32t/HWMMKS5KIx4lZ2PgcOMlLnr+7L4+ uBrzxqnwtzc= =bqHT -----END PGP SIGNATURE-----