Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908) * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included for automation controller: * Fixed an issue where the traceback from host_metric_summary_monthly task caused a type comparison error (AAP-37486) * Fixed an issue where the order of source inventories was not respected by the ansible.controller collection (AAP-38511) * automation-controller has been updated to 4.5.17 Updates and fixes for installer and setup: * Fixed an issue where setting the pg_host= without any other context would result in an empty HOST section of settings.py in controller (AAP-38030) * Fixed an issue where Automation Hub backup would fail when automationhub_pg_port=" (AAP-31261) * Fixed an issue where providing the database installation a custom port would break the installation of postgres (AAP-31260) * Setup script now warns if provided log path does not have write permission and fails if default path does not have write permission (AAP-18204) * installer and setup have been updated to 2.4-9 Additional fixes: * python3-jinja2/python39-jinja2 has been updated to 3.1.5 * python3-pulpcore/python39-pulpcore has been updated to 3.28.26
AI Analysis
Technical Summary
This advisory covers three main security issues in Red Hat Ansible Automation Platform 2.4: (1) a sandbox breakout in Jinja2 templating through indirect reference to the format method (CVE-2024-56326), (2) a sandbox breakout via malicious filenames in Jinja2 (CVE-2024-56201), and (3) a potential SQL injection vulnerability in the HasKey(lhs, rhs) function on Oracle databases within the automation controller (CVE-2024-53908). These vulnerabilities affect the automation-controller and python3-jinja2 components. Red Hat has released fixed versions including automation-controller 4.5.17 and python3-jinja2 3.1.5 to address these issues. Additional bug fixes and installer improvements are also included in this update.
Potential Impact
The vulnerabilities allow attackers to bypass sandbox restrictions in Jinja2 templates, potentially enabling execution of unauthorized code or commands. The SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on Oracle databases via the automation controller. These issues pose a high security risk as they can lead to unauthorized access or code execution within the affected environment.
Mitigation Recommendations
Red Hat has released official fixes for these vulnerabilities. Users should update the automation-controller to version 4.5.17 and python3-jinja2 to version 3.1.5 as provided in the Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update. The installer and setup components have also been updated and should be applied accordingly. Applying these updates will remediate the sandbox breakout and SQL injection vulnerabilities.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908) * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included for automation controller: * Fixed an issue where the traceback from host_metric_summary_monthly task caused a type comparison error (AAP-37486) * Fixed an issue where the order of source inventories was not respected by the ansible.controller collection (AAP-38511) * automation-controller has been updated to 4.5.17 Updates and fixes for installer and setup: * Fixed an issue where setting the pg_host= without any other context would result in an empty HOST section of settings.py in controller (AAP-38030) * Fixed an issue where Automation Hub backup would fail when automationhub_pg_port=" (AAP-31261) * Fixed an issue where providing the database installation a custom port would break the installation of postgres (AAP-31260) * Setup script now warns if provided log path does not have write permission and fails if default path does not have write permission (AAP-18204) * installer and setup have been updated to 2.4-9 Additional fixes: * python3-jinja2/python39-jinja2 has been updated to 3.1.5 * python3-pulpcore/python39-pulpcore has been updated to 3.28.26
Affected software
pkg:rpm/redhat/automation-controllerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers three main security issues in Red Hat Ansible Automation Platform 2.4: (1) a sandbox breakout in Jinja2 templating through indirect reference to the format method (CVE-2024-56326), (2) a sandbox breakout via malicious filenames in Jinja2 (CVE-2024-56201), and (3) a potential SQL injection vulnerability in the HasKey(lhs, rhs) function on Oracle databases within the automation controller (CVE-2024-53908). These vulnerabilities affect the automation-controller and python3-jinja2 components. Red Hat has released fixed versions including automation-controller 4.5.17 and python3-jinja2 3.1.5 to address these issues. Additional bug fixes and installer improvements are also included in this update.
Potential Impact
The vulnerabilities allow attackers to bypass sandbox restrictions in Jinja2 templates, potentially enabling execution of unauthorized code or commands. The SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on Oracle databases via the automation controller. These issues pose a high security risk as they can lead to unauthorized access or code execution within the affected environment.
Mitigation Recommendations
Red Hat has released official fixes for these vulnerabilities. Users should update the automation-controller to version 4.5.17 and python3-jinja2 to version 3.1.5 as provided in the Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update. The installer and setup components have also been updated and should be applied accordingly. Applying these updates will remediate the sandbox breakout and SQL injection vulnerabilities.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:0721
- Cve Count
- 3
- Additional Cves
- ["CVE-2024-56201","CVE-2024-56326"]
Threat ID: 6a1f4e92e29bf47b50085e4d
Added to database: 06/02/2026, 21:43:46 UTC
Last enriched: 08/11/2026, 20:43:58 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 117
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.