Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * automation-controller: Django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374) * python3.11-django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374) * python3.11-django: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907) * python3.11-jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * python3.11-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation controller * Fixed an issue where the order of source inventories was not respected by the ansible.controller collection (AAP-38524) * Fixed an issue where an actively running job on an execution node may have had its folder deleted by a system task (AAP-38137) * automation-controller has been updated to 4.6.7 Event-Driven Ansible: * Fixed an issue where users were unable to filter Rule Audits by rulebook activation name (AAP-39253) * Users are now able to create a new Event-Driven Ansible credential by copying an existing one (AAP-39249) * Added support for file and env injectors for Credentials (AAP-39091) * Fixed an issue where the input field of the injector configuration could not be empty (AAP-39086) * Fixed an issue where the application version in the openapi spec was incorrectly set (AAP-38392) * Fixed an issue where activations were not properly updated in some scenarios with a high load of the system (AAP-38374) * automation-eda-controller has been updated to 1.1.4 Container-based Ansible Automation Platform * Allow user to not provide the Postgresql admin account with external database (AAP-39077) * Using PostgreSQL TLS certificate authentication with an external database is now available (AAP-38400) * containerized installer setup has been updated to 2.5-9 RPM-based Ansible Automation Platform * Fixed an issue where gateway could not be setup with custom SSL certificates (AAP-38985) * Fixed an issue where the gateway services are not restarted when a dependency changes (AAP-38918) * Fixed an issue where setting automationedacontroller_max_running_activations could cause the installer to fail (AAP-38708) * ansible-automation-platform-installer and installer setup have been updated to 2.5-8 Additional changes: * python3.11-django has been updated to 4.2.18 * python3.11-jinja2 has been updated to 3.1.5 * python3.11-pulpcore has been updated to 3.49.30
AI Analysis
Technical Summary
Red Hat Ansible Automation Platform versions prior to 2.5.9 and related components are affected by several security vulnerabilities. Notably, Jinja2 has sandbox breakout vulnerabilities via indirect references to the format method (CVE-2024-56326) and malicious filenames (CVE-2024-56201). Django components have potential denial-of-service vulnerabilities in IPv6 validation (CVE-2024-56374) and in django.utils.html.strip_tags() (CVE-2024-53907). Additionally, a potential SQL injection vulnerability in Django's HasKey(lhs, rhs) on Oracle was addressed (CVE-2024-53908). Red Hat has released patched versions including automation-controller 4.6.7, python3.11-django 4.2.18, and python3.11-jinja2 3.1.5. These fixes address the sandbox breakout, denial-of-service, and injection vulnerabilities to improve the security posture of the platform.
Potential Impact
The vulnerabilities could allow an attacker to escape the Jinja2 sandbox, potentially leading to unauthorized code execution or manipulation of templates. Denial-of-service vulnerabilities in Django components could allow attackers to disrupt service availability by exploiting IPv6 validation or HTML tag stripping functions. The SQL injection vulnerability could allow unauthorized database queries on Oracle backends. These issues collectively pose a high security risk to affected Red Hat Ansible Automation Platform deployments if left unpatched.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities. Users should upgrade to automation-controller version 4.6.7 or later, python3.11-django version 4.2.18 or later, and python3.11-jinja2 version 3.1.5 or later. The updates are available for Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 9, as well as version 2.4. Applying these updates will remediate the sandbox breakout, denial-of-service, and SQL injection vulnerabilities. No additional mitigation actions are required beyond applying the vendor-provided fixes.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) * automation-controller: Django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374) * python3.11-django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374) * python3.11-django: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907) * python3.11-jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326) * python3.11-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation controller * Fixed an issue where the order of source inventories was not respected by the ansible.controller collection (AAP-38524) * Fixed an issue where an actively running job on an execution node may have had its folder deleted by a system task (AAP-38137) * automation-controller has been updated to 4.6.7 Event-Driven Ansible: * Fixed an issue where users were unable to filter Rule Audits by rulebook activation name (AAP-39253) * Users are now able to create a new Event-Driven Ansible credential by copying an existing one (AAP-39249) * Added support for file and env injectors for Credentials (AAP-39091) * Fixed an issue where the input field of the injector configuration could not be empty (AAP-39086) * Fixed an issue where the application version in the openapi spec was incorrectly set (AAP-38392) * Fixed an issue where activations were not properly updated in some scenarios with a high load of the system (AAP-38374) * automation-eda-controller has been updated to 1.1.4 Container-based Ansible Automation Platform * Allow user to not provide the Postgresql admin account with external database (AAP-39077) * Using PostgreSQL TLS certificate authentication with an external database is now available (AAP-38400) * containerized installer setup has been updated to 2.5-9 RPM-based Ansible Automation Platform * Fixed an issue where gateway could not be setup with custom SSL certificates (AAP-38985) * Fixed an issue where the gateway services are not restarted when a dependency changes (AAP-38918) * Fixed an issue where setting automationedacontroller_max_running_activations could cause the installer to fail (AAP-38708) * ansible-automation-platform-installer and installer setup have been updated to 2.5-8 Additional changes: * python3.11-django has been updated to 4.2.18 * python3.11-jinja2 has been updated to 3.1.5 * python3.11-pulpcore has been updated to 3.49.30
Affected software
pkg:rpm/redhat/automation-controllerpkg:rpm/redhat/python3.11-djangoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Ansible Automation Platform versions prior to 2.5.9 and related components are affected by several security vulnerabilities. Notably, Jinja2 has sandbox breakout vulnerabilities via indirect references to the format method (CVE-2024-56326) and malicious filenames (CVE-2024-56201). Django components have potential denial-of-service vulnerabilities in IPv6 validation (CVE-2024-56374) and in django.utils.html.strip_tags() (CVE-2024-53907). Additionally, a potential SQL injection vulnerability in Django's HasKey(lhs, rhs) on Oracle was addressed (CVE-2024-53908). Red Hat has released patched versions including automation-controller 4.6.7, python3.11-django 4.2.18, and python3.11-jinja2 3.1.5. These fixes address the sandbox breakout, denial-of-service, and injection vulnerabilities to improve the security posture of the platform.
Potential Impact
The vulnerabilities could allow an attacker to escape the Jinja2 sandbox, potentially leading to unauthorized code execution or manipulation of templates. Denial-of-service vulnerabilities in Django components could allow attackers to disrupt service availability by exploiting IPv6 validation or HTML tag stripping functions. The SQL injection vulnerability could allow unauthorized database queries on Oracle backends. These issues collectively pose a high security risk to affected Red Hat Ansible Automation Platform deployments if left unpatched.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities. Users should upgrade to automation-controller version 4.6.7 or later, python3.11-django version 4.2.18 or later, and python3.11-jinja2 version 3.1.5 or later. The updates are available for Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 9, as well as version 2.4. Applying these updates will remediate the sandbox breakout, denial-of-service, and SQL injection vulnerabilities. No additional mitigation actions are required beyond applying the vendor-provided fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:0777
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-56201","CVE-2024-56326","CVE-2024-56374"]
Threat ID: 6a1f4e8fe29bf47b50085bfa
Added to database: 06/02/2026, 21:43:43 UTC
Last enriched: 08/11/2026, 20:43:25 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.