CVE-2024-6840
Fixed in a distro release EPSS <1%CVSS 6.6
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.
Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ansible automation platform 2.4 | automation-controller | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-cli | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-cli | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-server | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-server | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-ui | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-ui | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-django | 0:4.2.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-grpcio | 0:1.58.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-grpcio-debugsource | 0:1.58.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-django | 0:4.2.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-grpcio | 0:1.58.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-grpcio-debuginfo | 0:1.58.3-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-django | 0:4.2.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-grpcio | 0:1.58.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-grpcio-debuginfo | 0:1.58.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-zipp | 0:3.19.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-django | 0:4.2.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-grpcio | 0:1.58.3-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-grpcio-debugsource | 0:1.58.3-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | automation-controller | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | automation-controller | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | automation-controller-cli | 0:4.5.10-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | automation-controller-cli | 0:4.5.10-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python39-zipp | 0:3.19.2-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-zipp | 0:3.19.2-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python39-zipp | 0:3.19.2-1.el8ap |