A flaw was found in Red Hat Ansible Automation Platform’s automation-
\ncontroller. Four debug views that trigger the internal task, dependency, and
\nworkflow schedulers are configured to allow any user (including unauthenticated
\nclients) and are routed in production builds because their URL include is not
\ngated on the debug setting. An unauthenticated remote attacker can repeatedly
\ninvoke these endpoints to acquire the cluster-wide scheduler advisory lock;
\nbecause the legitimate scheduler acquires the same lock without waiting, the
\nattacker causes real scheduler runs to be skipped, stalling job dispatch for
\nall tenants, while also consuming controller web workers. The debug root view
\nadditionally discloses the list of debug endpoints to unauthenticated callers.<\/p>\n","protected":false},"excerpt":{"rendered":"
A flaw was found in Red Hat Ansible Automation Platform’s automation-
\ncontroller. Four debug views that trigger the internal task, dependency, and
\nworkflow schedulers are configured to allow any user <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28131","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}