This advisory covers a security update for Red Hat OpenStack Platform 17.1.4, specifically a rebuild of ansible-core based on Python 3.9. It addresses three vulnerabilities: two sandbox breakout issues in Jinja (CVE-2024-56201 via malicious filenames and CVE-2024-56326 via indirect reference to the format method) and a vulnerability in ansible-core (CVE-2024-9902) that may allow users to read or write unauthorized content. Red Hat has rated this update as important and provides updated packages for affected versions. The advisory references the CVE pages for detailed impact and scoring information. The update is available as RPM packages for Red Hat OpenStack Platform 17.1 on RHEL 9 x86_64.

The vulnerabilities allow potential sandbox breakout in Jinja templates and unauthorized read/write access by ansible-core users, which could lead to privilege escalation or unauthorized data access within affected Red Hat OpenStack Platform deployments. Red Hat classifies the security impact as important, indicating a high risk if left unpatched. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for openstack-ansible-core version 2.14.2-4.6.el9ost that addresses these vulnerabilities. Users of Red Hat OpenStack Platform 17.1 on RHEL 9.2 should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.