automation-controller-server vulnerabilities (Red Hat)
167 vulnerabilities.
-
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update 9.9 Critical -
automation-controller-serverRed Hat Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process 6.6 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle 6.5 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust 4.3 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates 5.3 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames 6.6 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership 5.3 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane) 9.9 Critical -
automation-controller-serverRed Hat Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-cor… 7.1 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in… 7.6 High -
automation-controller-serverRed Hat Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups 9.1 Critical -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_key and database credentials to an admin… 8.7 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling… 8.7 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatenode survey min/max validation error me… 7.7 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod 9.9 Critical -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisionin… 9.9 Critical -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation o… 8.2 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable 3.1 Low -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard 3.1 Low -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks 2.7 Low -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod 4.1 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/ 4.3 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure 5.0 Medium -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration 5.0 Medium -
automation-controller-serverRed Hat GitPython before 3.1.60 Denial of Service via ReDoS 8.7 High -
automation-controller-serverRed Hat GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation 8.7 High -
automation-controller-serverRed Hat Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization… 6.4 Medium -
automation-controller-serverRed Hat GitPython before 3.1.59 Arbitrary File Read via TagReference.create 7.1 High -
automation-controller-serverRed Hat Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf 9.6 Critical -
automation-controller-serverRed Hat DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook 5.1 Medium -
automation-controller-serverRed Hat sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger 8.7 High -
automation-controller-serverRed Hat sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) 7.5 High -
automation-controller-serverRed Hat sqlparse: Quadratic O(n²) DoS in group_comments 8.7 High -
automation-controller-serverRed Hat Limit handshake messages we are willing to accept post-handshake in crypto/tls 7.5 High -
automation-controller-serverRed Hat Avoid quadratic complexity in resolvePath in net/url 5.9 Medium -
automation-controller-serverRed Hat Add recursion depth guard during decode in encoding/xml 7.5 High -
automation-controller-serverRed Hat Fix Javascript regexp context tracking in html/template 6.1 Medium - Show olderLoading…