A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.
A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.
The Event-Driven Automation (EDA) in Ansible Automation Platform (AAP) in versions equal to or below 2.4 lacks encryption of sensitive information, such as ServiceNow's credentials on an integration. This vulnerability leaves sensitive data in plaintext, as the component does not use AAP's built-in encryption features like in AAP's Survey.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.<br>Updates:<br><li> automation-controller 4.5.0</li> <li> ansible-core 2.15.8</li> <li> python39-galaxy-importer 0.4.18-1</li> <li> Fix restore issue resulting in database conflicts because the installer and restore roles were both connecting to the database at the same time (AAP-18442)</li> <li> Prevent the Resource Operator container from getting OOMKilled by throttling the number of concurrent reconciles allowed (AAP-17813)</li> <li> Add hop node support for Openshift-based deployments to give users more ways to route traffic from control nodes to remote execution nodes (AAP-6078)</li> <li> Add the option to force drop the database when doing a restore with the controller operator to drop all connections to the database (AAP-18515)</li>
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.Updates and fixes: automation-controller has been updated to 4.4.5 (AAP-16474) galaxy-importer has been updated to 0.4.13 (AAP-16551) fix ansible-compat dependency with ansible-lint (AAP-16393) update amazon.aws collection to 6.4.0 in ee-supported (AAP-15138)