CVE-2024-1657

HIGH

Red Hat Ansible Automation Platform 2.4 for RHEL 8/9 - Cleartext Transmission of Sensitive Information via WebSocket

Title source: llm
STIX 2.1

Description

A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.

References (3)

Core 3
Core References
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2265085
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:1057
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2024-1657

Scores

CVSS v3 8.1
EPSS 0.0038
EPSS Percentile 29.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-319
Status published
Products (4)
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:1.0.5-1.el8ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:2.4-6.el8ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:1.0.5-1.el9ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:2.4-6.el9ap
Published Apr 25, 2024
Tracked Since Feb 18, 2026