Description
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Default version status: affected
0:1.1.11-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
Default version status: affected
0:1.1.11-1.el9ap to < *unaffected