Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.
Security Fix(es):
* avahi: Avahi Wide-Area DNS Predictable Transaction IDs (CVE-2024-52616)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The Discovery container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).
This release resolves the following CVEs:
* discovery-server-container: HTTP Request Smuggling in benoitc/gunicorn (CVE-2025-26699)
* discovery-server-container: Potential denial-of-service vulnerability in django.utils.text.wrap() (CVE-2024-6827)
Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
Security Fix(es):
* automation-gateway: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updates and fixes included:
Automation Platform
* Fixed an issue that would prevent some types of resources from getting synced if there was a naming conflict (AAP-41241)
* Fixed an issue where login would fail for users who were members of a team or organization that had a naming conflict (AAP-41240)
* Fixed an issue in the user collection module where running with state: present would cause a stack trace (AAP-40887)
* Fixed an issue preventing the controller admin password to get set for the gateway admin account during upgrades (AAP-40839)
* Fixed an issue that caused updates to SAML authenticators to ignore an updated public certificate provided via UI or API and then fail with the message "The certificate and private key do not match" (AAP-40767)
* Allow services to request cloud.redhat.com settings from gateway using ServiceTokenAuth (AAP-39649)
* Fixed ServiceAuthToken destroy method to allow HTTP delete via ServiceAuth to work properly (AAP-37630)
* automation-gateway has been updated to 2.5.20250312
* python3.11-django-ansible-base has been updated to 2.5.20250312
Automation controller
* Fixed the indirect host counting name to not record the hostname, but from the query result instead (AAP-41033)
* Fixed OpaClient to initialize properly after timeouts and retries (AAP-40997)
* Added service account credentials for Analytics in controller (AAP-40769)
* Added a helper method in the API for fetching the service account token from sso.redhat.com (AAP-39637)
* automation-controller has been updated to 4.6.9
Event-Driven Ansible
* Fixed ansible-rulebook support for third party python libraries (AAP-41341)
* Modified the behavior of the ansible-rulebook and Event-Driven Ansible to help with issues when the activation correctly started was considered unresponsive and scheduled for restarting (AAP-41070)
* Added support for editing and copying of rulebook activations in the API (AAP-40254)
* Rulebook activations' log message field is separated into timestamps and message fields (AAP-39743)
* Fixed a bug where the activation was incorrectly restarted with the error message "Missing container for running activation" (AAP-39545)
* Event streams now connect to PostgreSQL by using the certificates configured at the installation (AAP-39294)
* User is now required to give a user defined name when copying a credential. The new credential name must be unique (AAP-39079)
* Enhanced error messages related to Decision Environments (AAP-38941)
* Decision environment urls are now validated against OCI specification to ensure successful authentication to the container registry when pulling the image (AAP-38822)
* ansible-rulebook has been updated to 1.1.3
* automation-eda-controller has been updated to 1.1.6
Receptor:
* Fixed an issue where receptor was creating too many inotify processes, and where the user would encounter a too many open files error (AAP-22605)
* receptor has been updated to 1.5.3
Container-based Ansible Automation Platform
* Corrected the URL in the postinstall code for automation hub to use the gateway proxy URL (AAP-41306)
* Deprecated the variables eda_main_url and hub_main_url in favor of the gateway proxy URL (AAP-41306)
* Receptor mesh connections are now created between all automation controller nodes (AAP-41102)
* Fixed receptor configuration related to the container group instances type (AAP-40431)
* Fixed behavior that would hide the errors during EDA status validation (AAP-40021)
* Ensure the polkit RPM package is installed in order to enable user lingering (AAP-39860)
* containerized installer setup has been updated to 2.5-11
RPM-based Ansible Automation Platform
* Fixed an issue where SELinux relabeling didn't happen when fcontext rules were changed (AAP-40489)
* Fixed an issue where the credentials for execution environments and decision environments hosted in automation hub were incorrectly configured (AAP-40419)
* Fixed an issue where projects failed to sync due to incorrectly configured credentials for ansible collections hosted in automation hub (AAP-40418)
* Managed CA will now correctly assign eligible groups during discovery during installation, backup
CVE-2022-23748 is a process control vulnerability in the Dante Discovery application, specifically in the mDNSResponder.exe component. This flaw allows a local attacker to perform a DLL sideloading attack, enabling arbitrary code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation.
Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.
SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component.
Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: S3Resume2Pei SHA256: 7bb29f05534a8a1e010443213451425098faebd45948a4642db969b19d0253fc Module GUID: 89E549B0-7CFE-449D-9BA3-10D8B2312D71
A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: SbPei SHA256: d827182e5f9b7a9ff0b9d3e232f7cfac43b5237e2681e11f005be627a49283a9 Module GUID: c1fbd624-27ea-40d1-aa48-94c3dc5c7e0d
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.
CERT-FR reports a campaign by the Sandworm intrusion set targeting Centreon systems primarily in Western Europe. The campaign exploits public-facing Linux applications to perform file discovery, deploy web shells, modify system processes, and exfiltrate data via command and control channels. Multiple threat actors including Iridium, Telebots, Sandworm, and Electrum are involved. The overall threat level is assessed as low by CERT-IST, with medium severity noted in the report. No patches are currently available for this threat.
