Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django: Memory exhaustion in django.utils.numberformat.floatformat() (CVE-2024-41989) * automation-controller: Django: Potential denial-of-service vulnerability in django.utils.html.urlize() (CVE-2024-45230) * automation-gateway: XSS on automation-gateway (CVE-2024-10033) * receptor: quic-go: memory exhaustion attack against QUIC's connection ID mechanism (CVE-2024-22189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: * With this update, upgrades from Ansible Automation Platform 2.4 to 2.5 are supported for RPM and Operator-based deployments for Automation controller and Automation hub. For more information on how to upgrade, refer to the Upgrading section of the AAP landing page. (ANSTRAT-809) Container-based Ansible Automation Platform * The TLS Certificate Authority private key can now use a passphrase. (AAP-33594) * Automation hub is populated with container images (decision and execution environments) and Ansible collections. (AAP-33759) * The Automation controller, Event-Driven Ansible, and automation hub legacy UIs now display a redirect page to the Platform UI rather than a blank page. (AAP-33794) * Fixed the uninstall playbook execution when the environment was already uninstalled. (AAP-32981) * containerized installer setup has been updated to 2.5-3 RPM-based Ansible Automation Platform * Added platform Redis to RPM-based Ansible Automation Platform. This allows a 6 node cluster for a Redis high availability (HA) deployment. (AAP-33773) * Removed the variable aap_caching_mtls and replaced it with redis_disable_tls and redis_disable_mtls which are boolean flags that disable Redis server TLS and Redis client certificate authentication. (AAP-33773) * An informative redirect page is now shown when going to automation controller, Event-Driven Ansible, or automation hub URL. (AAP-33827) * ansible-automation-platform-installer and installer setup have been updated to 2.5-4 Additional changes: * automation-controller has been updated to 4.6.2 * automation-eda-controller has been updated to 1.1.2 * automation-gateway has been updated to 2.5.3 * automation-hub/python3.11-galaxy-ng has been updated to 4.10.1 * python3.11-django-ansible-base has been updated to 2.5.3 * receptor has been updated to 1.4.9
AI Analysis
Technical Summary
This advisory covers four security vulnerabilities in Red Hat Ansible Automation Platform 2.5: CVE-2024-41989 (memory exhaustion in django.utils.numberformat.floatformat()), CVE-2024-45230 (potential denial-of-service in django.utils.html.urlize()), CVE-2024-10033 (XSS vulnerability in automation-gateway), and CVE-2024-22189 (memory exhaustion attack against QUIC connection ID mechanism in receptor). The update includes fixes for these issues by upgrading affected components such as automation-controller, automation-gateway, receptor, and Django-based packages. The update also supports upgrades from version 2.4 to 2.5 and introduces enhancements like TLS private key passphrase support and Redis high availability for RPM-based deployments.
Potential Impact
The vulnerabilities could allow attackers to cause memory exhaustion leading to denial-of-service conditions and execute cross-site scripting attacks within the automation-gateway component. These issues may disrupt automation workflows or expose the platform to malicious script execution. The overall security impact is rated moderate by Red Hat.
Mitigation Recommendations
Red Hat has released an official product release update for Ansible Automation Platform 2.5 that addresses these vulnerabilities. Users should apply the update which includes upgraded component versions such as automation-controller 4.6.2, automation-gateway 2.5.3, receptor 1.4.9, and updated Django packages. The update also supports direct upgrades from 2.4 to 2.5. No additional mitigation steps are indicated beyond applying this official update.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: Django: Memory exhaustion in django.utils.numberformat.floatformat() (CVE-2024-41989) * automation-controller: Django: Potential denial-of-service vulnerability in django.utils.html.urlize() (CVE-2024-45230) * automation-gateway: XSS on automation-gateway (CVE-2024-10033) * receptor: quic-go: memory exhaustion attack against QUIC's connection ID mechanism (CVE-2024-22189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: * With this update, upgrades from Ansible Automation Platform 2.4 to 2.5 are supported for RPM and Operator-based deployments for Automation controller and Automation hub. For more information on how to upgrade, refer to the Upgrading section of the AAP landing page. (ANSTRAT-809) Container-based Ansible Automation Platform * The TLS Certificate Authority private key can now use a passphrase. (AAP-33594) * Automation hub is populated with container images (decision and execution environments) and Ansible collections. (AAP-33759) * The Automation controller, Event-Driven Ansible, and automation hub legacy UIs now display a redirect page to the Platform UI rather than a blank page. (AAP-33794) * Fixed the uninstall playbook execution when the environment was already uninstalled. (AAP-32981) * containerized installer setup has been updated to 2.5-3 RPM-based Ansible Automation Platform * Added platform Redis to RPM-based Ansible Automation Platform. This allows a 6 node cluster for a Redis high availability (HA) deployment. (AAP-33773) * Removed the variable aap_caching_mtls and replaced it with redis_disable_tls and redis_disable_mtls which are boolean flags that disable Redis server TLS and Redis client certificate authentication. (AAP-33773) * An informative redirect page is now shown when going to automation controller, Event-Driven Ansible, or automation hub URL. (AAP-33827) * ansible-automation-platform-installer and installer setup have been updated to 2.5-4 Additional changes: * automation-controller has been updated to 4.6.2 * automation-eda-controller has been updated to 1.1.2 * automation-gateway has been updated to 2.5.3 * automation-hub/python3.11-galaxy-ng has been updated to 4.10.1 * python3.11-django-ansible-base has been updated to 2.5.3 * receptor has been updated to 1.4.9
Affected software
pkg:rpm/redhat/ansible-automation-platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers four security vulnerabilities in Red Hat Ansible Automation Platform 2.5: CVE-2024-41989 (memory exhaustion in django.utils.numberformat.floatformat()), CVE-2024-45230 (potential denial-of-service in django.utils.html.urlize()), CVE-2024-10033 (XSS vulnerability in automation-gateway), and CVE-2024-22189 (memory exhaustion attack against QUIC connection ID mechanism in receptor). The update includes fixes for these issues by upgrading affected components such as automation-controller, automation-gateway, receptor, and Django-based packages. The update also supports upgrades from version 2.4 to 2.5 and introduces enhancements like TLS private key passphrase support and Redis high availability for RPM-based deployments.
Potential Impact
The vulnerabilities could allow attackers to cause memory exhaustion leading to denial-of-service conditions and execute cross-site scripting attacks within the automation-gateway component. These issues may disrupt automation workflows or expose the platform to malicious script execution. The overall security impact is rated moderate by Red Hat.
Mitigation Recommendations
Red Hat has released an official product release update for Ansible Automation Platform 2.5 that addresses these vulnerabilities. Users should apply the update which includes upgraded component versions such as automation-controller 4.6.2, automation-gateway 2.5.3, receptor 1.4.9, and updated Django packages. The update also supports direct upgrades from 2.4 to 2.5. No additional mitigation steps are indicated beyond applying this official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:8534
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-22189","CVE-2024-41989","CVE-2024-45230"]
- Cvss Version
- null
Threat ID: 6a1f4ea0e29bf47b50087863
Added to database: 06/02/2026, 21:44:00 UTC
Last enriched: 07/04/2026, 01:25:19 UTC
Last updated: 07/25/2026, 08:51:57 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.