Red Hat Ansible Automation Platform: Multiple vulnerabilities in GitPython

Red Hat Ansible Automation Platform is affected by multiple vulnerabilities originating from its dependency on the GitPython library. These vulnerabilities permit an unauthenticated remote attacker to achieve arbitrary code execution, conduct unauthorized local file disclosure, and trigger a denial-of-service (DoS) condition. As of the current advisory, specific CVE identifiers have not been disclosed, and the extent of the vulnerability remains limited to the documented impacts.

Impact

Successful exploitation may lead to full system compromise through arbitrary code execution, loss of confidentiality via unauthorized file disclosure, or service interruption through a DoS condition.

Recommendation

• Inventory all deployments of Red Hat Ansible Automation Platform within the organization.
• Monitor official Red Hat security advisories for the release of patches specifically addressing GitPython-related vulnerabilities.
• Restrict access to management interfaces for Ansible Automation Platform to trusted networks to reduce the exposure to unauthenticated remote attackers.