Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908) * automation-controller: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907) * automation-controller: Denial of Service through Data corruption in gRPC-C++ (CVE-2024-11407) * automation-gateway: nanoid mishandles non-integer values (CVE-2024-55565) * python3.11-aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Platform * Fixed 'not found' error that occurred occasionally when navigating form wizards (AAP-37495) * Fixed an issue where ID_KEY attribute was improperly used to determine the username field in social auth pipelines (AAP-38300) * Fixed an issue where the X-DAB-JW-TOKEN header message would flood logs (AAP-38169) * Fixed an issue where authenticator could create a userid and return a non-viable authenticator_uid (AAP-38021) * Enhanced the status API, /api/gateway/v1/status/, from the services property within the JSON to an array (AAP-37903) * Fixes an issue where a private key was displayed in plain text when downloading the OpenAPI schema file. NOTE: This was not the private key used by gateway, just a random default key (AAP-37843) Automation controller * Added 'job_lifecycle' as a choice in loggers to send externally and added 'organization_id' field to logs related to a job (AAP-37537) * Fixed date comparison mismatch for traceback from 'host_metric_summary_monthly' task (AAP-37487) * Fixed scheduled jobs with count set to a non-zero value to no longer run unexpectedly (AAP-37290) * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error (AAP-37235) * Fixed the behavior of the project's 'requirements.yml' to no longer revert to a prior state in a cluster (AAP-37228) * Fixed occasional error while creating event partition table before starting a job, when lots of jobs are launched quickly (AAP-37227) * Fixed the named URL to no longer return a 404 error code while launching a job template (AAP-37025) * Updated receptor to clean up temporary receptor files after a job completes on nodes (AAP-36904) * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error (AAP-33911) * automation-controller has been updated to 4.6.6 Container-based Ansible Automation Platform * Fixed an issue where the provided inventory file sample for growth inventories could cause the installation to stall on low resource systems (AAP-38372) * Fixed an issue where the throttle capacity of controller in growth topology installation would allow for performance degradation (AAP-38207) * Fixed an issue where the receptor TLS certificate content was not validated during the preflight role execution ensuring that the x509 Subject Alt Name (SAN) field contains the required ISO Object Identifier (OID) (AAP-37880) * TLS certificate and key files are now validated during the preflight role execution (AAP-37845) * Fixed an issue where the Postgresql SSL mode variables were not validated during the preflight role execution (AAP-37352) * containerized installer setup has been updated to 2.5-8 RPM-based Ansible Automation Platform * Fixed an issue where adding a new automation hub host to upgraded environment has caused the installation to fail (AAP-38204) * Fixed an issue where the link to the documents in the installer README.md was broken (AAP-37627) * Updated nginx configuration to properly return API status for Event-Driven Ansible event stream service (AAP-32816) * ansible-automation-platform-installer and installer setup have been updated to 2.5-7 Additional changes: * Installing ansible-core no longer installs python3-jmespath on RHEL 8 (AAP-18251) * ansible-core has been updated to 2.16.14-2 * automation-gateway has been updated to 2.5.20250115 * python3.11-aiohttp has been updated to 3.10.11 along with its dependencies * python3.11-django-ansible-base has been updated to 2.5.20250115 * python3.11-galaxy-importer has been updated to 0.4.27 * python3.11-pulpcore has been updated to 3.49.29
AI Analysis
Technical Summary
This advisory covers multiple security fixes for Red Hat Ansible Automation Platform 2.5, including CVE-2024-11407 which is a denial of service vulnerability caused by data corruption in gRPC-C++. Additional fixes address sandbox breakout vulnerabilities in Jinja2 templates (CVE-2024-56201 and CVE-2024-56326), request smuggling in aiohttp due to incorrect parsing of chunk extensions (CVE-2024-52304), and a potential SQL injection in the automation-controller component (CVE-2024-53908). The updates are provided for container and RPM-based installations on Red Hat Enterprise Linux 8 and 9 architectures. The vendor advisory confirms that patches are available and provides updated package versions to remediate these issues.
Potential Impact
The vulnerabilities could allow attackers to bypass sandbox restrictions in Jinja2 templates, potentially executing unauthorized code. The request smuggling vulnerability in aiohttp could enable HTTP request manipulation. The denial of service vulnerability in gRPC-C++ could disrupt automation services by causing data corruption. The SQL injection vulnerability in the automation-controller could allow unauthorized database queries. Collectively, these issues pose risks of service disruption, unauthorized code execution, and data compromise within environments using affected versions of Red Hat Ansible Automation Platform 2.5.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities in Red Hat Ansible Automation Platform 2.5. Users should apply the updates provided in the advisories RHSA-2025:0340 and RHSA-2025:0341 promptly to remediate these issues. The vendor advisory includes updated package versions and container images for all affected architectures and RHEL versions. No additional mitigations are indicated beyond applying the official fixes.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908) * automation-controller: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907) * automation-controller: Denial of Service through Data corruption in gRPC-C++ (CVE-2024-11407) * automation-gateway: nanoid mishandles non-integer values (CVE-2024-55565) * python3.11-aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Platform * Fixed 'not found' error that occurred occasionally when navigating form wizards (AAP-37495) * Fixed an issue where ID_KEY attribute was improperly used to determine the username field in social auth pipelines (AAP-38300) * Fixed an issue where the X-DAB-JW-TOKEN header message would flood logs (AAP-38169) * Fixed an issue where authenticator could create a userid and return a non-viable authenticator_uid (AAP-38021) * Enhanced the status API, /api/gateway/v1/status/, from the services property within the JSON to an array (AAP-37903) * Fixes an issue where a private key was displayed in plain text when downloading the OpenAPI schema file. NOTE: This was not the private key used by gateway, just a random default key (AAP-37843) Automation controller * Added 'job_lifecycle' as a choice in loggers to send externally and added 'organization_id' field to logs related to a job (AAP-37537) * Fixed date comparison mismatch for traceback from 'host_metric_summary_monthly' task (AAP-37487) * Fixed scheduled jobs with count set to a non-zero value to no longer run unexpectedly (AAP-37290) * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error (AAP-37235) * Fixed the behavior of the project's 'requirements.yml' to no longer revert to a prior state in a cluster (AAP-37228) * Fixed occasional error while creating event partition table before starting a job, when lots of jobs are launched quickly (AAP-37227) * Fixed the named URL to no longer return a 404 error code while launching a job template (AAP-37025) * Updated receptor to clean up temporary receptor files after a job completes on nodes (AAP-36904) * Fixed the POST operation to '/api/controller/login/' via gateway to no longer result in a fatal error (AAP-33911) * automation-controller has been updated to 4.6.6 Container-based Ansible Automation Platform * Fixed an issue where the provided inventory file sample for growth inventories could cause the installation to stall on low resource systems (AAP-38372) * Fixed an issue where the throttle capacity of controller in growth topology installation would allow for performance degradation (AAP-38207) * Fixed an issue where the receptor TLS certificate content was not validated during the preflight role execution ensuring that the x509 Subject Alt Name (SAN) field contains the required ISO Object Identifier (OID) (AAP-37880) * TLS certificate and key files are now validated during the preflight role execution (AAP-37845) * Fixed an issue where the Postgresql SSL mode variables were not validated during the preflight role execution (AAP-37352) * containerized installer setup has been updated to 2.5-8 RPM-based Ansible Automation Platform * Fixed an issue where adding a new automation hub host to upgraded environment has caused the installation to fail (AAP-38204) * Fixed an issue where the link to the documents in the installer README.md was broken (AAP-37627) * Updated nginx configuration to properly return API status for Event-Driven Ansible event stream service (AAP-32816) * ansible-automation-platform-installer and installer setup have been updated to 2.5-7 Additional changes: * Installing ansible-core no longer installs python3-jmespath on RHEL 8 (AAP-18251) * ansible-core has been updated to 2.16.14-2 * automation-gateway has been updated to 2.5.20250115 * python3.11-aiohttp has been updated to 3.10.11 along with its dependencies * python3.11-django-ansible-base has been updated to 2.5.20250115 * python3.11-galaxy-importer has been updated to 0.4.27 * python3.11-pulpcore has been updated to 3.49.29
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers multiple security fixes for Red Hat Ansible Automation Platform 2.5, including CVE-2024-11407 which is a denial of service vulnerability caused by data corruption in gRPC-C++. Additional fixes address sandbox breakout vulnerabilities in Jinja2 templates (CVE-2024-56201 and CVE-2024-56326), request smuggling in aiohttp due to incorrect parsing of chunk extensions (CVE-2024-52304), and a potential SQL injection in the automation-controller component (CVE-2024-53908). The updates are provided for container and RPM-based installations on Red Hat Enterprise Linux 8 and 9 architectures. The vendor advisory confirms that patches are available and provides updated package versions to remediate these issues.
Potential Impact
The vulnerabilities could allow attackers to bypass sandbox restrictions in Jinja2 templates, potentially executing unauthorized code. The request smuggling vulnerability in aiohttp could enable HTTP request manipulation. The denial of service vulnerability in gRPC-C++ could disrupt automation services by causing data corruption. The SQL injection vulnerability in the automation-controller could allow unauthorized database queries. Collectively, these issues pose risks of service disruption, unauthorized code execution, and data compromise within environments using affected versions of Red Hat Ansible Automation Platform 2.5.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities in Red Hat Ansible Automation Platform 2.5. Users should apply the updates provided in the advisories RHSA-2025:0340 and RHSA-2025:0341 promptly to remediate these issues. The vendor advisory includes updated package versions and container images for all affected architectures and RHEL versions. No additional mitigations are indicated beyond applying the official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:0340
- Cve Count
- 5
- Additional Cves
- ["CVE-2024-52304","CVE-2024-53907","CVE-2024-53908","CVE-2024-55565"]
Threat ID: 6a1f4e9ee29bf47b50086ed5
Added to database: 06/02/2026, 21:43:58 UTC
Last enriched: 08/11/2026, 20:46:08 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.