[ Bug ] ansible-core CVEs

[gwright99]

Background

While fixing other detected CVEs, two ansible-core CVEs remained after the latest scan.

• CVE-2024-11079 could be fixed by moving from 2.15.13 --> 2.18.1rc1
• CVE-2024-8775 does not have an available fix

Investigation

As per @schaluva:

• Standard pip install ansible-core pulls in a stable (impacted) version.
• Running pip install git+https://github.com/ansible/[email protected] retrieves the RC but throws a Python dependency error: ERROR: Package 'ansible-core' requires a different Python: 3.9.20 not in '>=3.11'

Decision

Current as of Feb 11, 2025: Will not fix.

Reasoning:

• Both vulnerabilities are not yet categorized.
• One of the vulnerabilities does not have a mitigation strategy.
• Upgrading Python means breaking from the native installation available via our chosen AMI (potentially impacting Python-dependent components of the solution).
• Disruption risk not worth the remediation reward, for now.

We will revisit this issue a few months from now to see if a better solution is available by then.