Platform: insecure websocket used when interacting with eda server
A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
ansible
Vendor
Unknown
Product
Unknown
Platforms
Unknown
Default status
unaffected
Package
ansible
Package collection
https://github.com/ansible/ansible
ansible · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
2.4
Unavailable
None listed
Red Hat Ansible Automation Platform 2.4 for RHEL 8
Vendor
Red Hat
Product
Red Hat Ansible Automation Platform 2.4 for RHEL 8