RHSA-2025:23069 - Security Advisory

Topic

An update is now available for Red Hat Ansible Automation Platform 2.5

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

Security Fix(es):

• automation-controller: Django SQL injection (CVE-2025-64459)
• python3.11-django: Django SQL injection (CVE-2025-64459)
• automation-eda-controller: Sensitive Internal Headers Disclosure in AAP EDA Event Streams (CVE-2025-9908)
• automation-eda-controller: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA (CVE-2025-9907)
• automation-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration (CVE-2025-9909)
• automation-gateway: Axios DoS via lack of data size check (CVE-2025-58754)
• receptor: quic-go Crash Due to Premature HANDSHAKE_DONE Frame (CVE-2025-59530)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updates and fixes included:

Automation Platform

• Fixed using "and" condition with multiple attributes. Where previously the authentication map would skip the missing attributes, with this fix the the map will be applied only if all attributes are present and the condition(s) are met (AAP-53523)
• Added UI changes to subscription management splash page (AAP-47864)
• Fixed an issue where job templates did not remain editable after associated project was deleted (AAP-58474)
• automation-gateway has been updated to 2.5.20251210
• python3.11-django-ansible-base has been updated to 2.5.20251210

Automation Controller

• Fixed an issue where jobs failed on fapolicyd enabled systems where python 3.9 was not installed by default (AAP-58479)
• Fixed an issue in receptor where some edge cases caused JSON to fail to parse (AAP-57253)
• Fixed GitHub App Installation Access Token Lookup to accept Iv2 Client IDs (AAP-58882)
• Updated controller to now use the force flag when syncing a project which has 'Allow branch override' enabled (AAP-58532)
• Fixed Redis broken pipe error in long-running jobs (AAP-59727)
• Fixed "column main_unifiedjobtemplate.org_unique does not exist" migration error (AAP-56221)
• ansible-runner has been updated to 2.4.2
• automation-controller has been updated to 4.6.23
• automation-controller-fapolicyd has been updated to 1.0-5
• receptor has been updated to 1.6.2

Automation Hub

• Autocomplete attribute added to the Automation Hub API password field (AAP-59912)
• automation-hub has been updated to 4.10.10
• python3.11-galaxy-ng has been updated to 4.10.10
• python3.11-galaxy-importer has been updated to 0.4.36

Event-Driven Ansible

• Added a credential type for mTLS event stream (AAP-55786)
• Fixed an issue where redis_tls does not support boolean values such as yes/no (AAP-52828)
• automation-eda-controller has been updated to 1.1.14

Container-based Ansible Automation Platform

• Fixed podman 5.6 compatibility with automation controller container configuration (AAP-58546)
• Removed EVENT_STREAM_MTLS_BASE_URL from EDA settings file avoiding duplicate entry when using eda_extra_settings variable (AAP-57587)
• RHEL minimum version has been updated to 9.4 (AAP-56386)
• nginx has been updated to 1.24 (AAP-56203)
• Containerized installer setup has been updated to 2.5-21

RPM-based Ansible Automation Platform

• Fixed an issue where the installer failed during execution environment image upload when there is no automation hub node in inventory (AAP-57122)
• RHEL minimum version has been updated to 8.10 and 9.4 (AAP-56386)
• nginx has been updated to 1.24 (AAP-56205)
• ansible-automation-platform-installer and installer setup have been updated to 2.5-20

Additional changes

• ansible-builder has been updated to 3.1.1
• ansible-creator has been updated to 25.12.0
• ansible-dev-environment has been updated to 25.12.2
• ansible-dev-tools has been updated to 25.12.0
• ansible-lint has been updated to 25.12.0
• ansible-navigator has been updated to 25.12.0
• ansible-sign has been updated to 0.1.4
• bindep has been updated to 2.13.0
• molecule has been updated to 25.12.0
• python3.11-ansible-compat has been updated to 25.12.0
• python3.11-distlib has been updated to 0.4.0
• python3.11-django has been updated to 4.2.26
• python3.11-execnet has been updated to 2.1.2
• python3.11-gunicorn has been updated to 23.0.0
• python3.11-pluggy has been updated to 1.6.0
• python3.11-pytest has been updated to 9.0.1
• python3.11-pytest-ansible has been updated to 25.12.0
• python3.11-pytest-xdist has been updated to 3.8.0
• python3.11-ruamel-yaml-clib has been updated to 0.2.15
• python3.11-subprocess-tee has been updated to 0.4.2
• python3.11-tox-ansible has been updated to 25.12.0
• python3.11-typing-extensions has been updated to 4.15.0

Solution

Red Hat Ansible Automation Platform

Affected Products

• Red Hat Ansible Automation Platform 2.5 for RHEL 9 x86_64
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 s390x
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 ppc64le
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 aarch64
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 x86_64
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 s390x
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 ppc64le
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 aarch64
• Red Hat Ansible Inside 1.3 for RHEL 9 x86_64
• Red Hat Ansible Inside 1.3 for RHEL 9 s390x
• Red Hat Ansible Inside 1.3 for RHEL 9 ppc64le
• Red Hat Ansible Inside 1.3 for RHEL 9 aarch64
• Red Hat Ansible Inside 1.3 for RHEL 8 x86_64
• Red Hat Ansible Inside 1.3 for RHEL 8 s390x
• Red Hat Ansible Inside 1.3 for RHEL 8 ppc64le
• Red Hat Ansible Inside 1.3 for RHEL 8 aarch64
• Red Hat Ansible Developer 1.2 for RHEL 9 x86_64
• Red Hat Ansible Developer 1.2 for RHEL 9 s390x
• Red Hat Ansible Developer 1.2 for RHEL 9 ppc64le
• Red Hat Ansible Developer 1.2 for RHEL 9 aarch64
• Red Hat Ansible Developer 1.2 for RHEL 8 x86_64
• Red Hat Ansible Developer 1.2 for RHEL 8 s390x
• Red Hat Ansible Developer 1.2 for RHEL 8 ppc64le
• Red Hat Ansible Developer 1.2 for RHEL 8 aarch64

Fixes

• BZ - 2392834 - CVE-2025-9907 event-driven-ansible: Event Stream Test Mode Exposes Sensitive Headers in AAP EDA
• BZ - 2392835 - CVE-2025-9908 event-driven-ansible: Sensitive Internal Headers Disclosure in AAP EDA Event Streams
• BZ - 2392836 - CVE-2025-9909 aap-gateway: Improper Path Validation in Gateway Allows Credential Exfiltration
• BZ - 2394735 - CVE-2025-58754 axios: Axios DoS via lack of data size check
• BZ - 2403125 - CVE-2025-59530 github.com/quic-go/quic-go: quic-go Crash Due to Premature HANDSHAKE_DONE Frame
• BZ - 2412651 - CVE-2025-64459 django: Django SQL injection

CVEs

• CVE-2025-9907
• CVE-2025-9908
• CVE-2025-9909
• CVE-2025-58754
• CVE-2025-59530
• CVE-2025-64459

References

• https://access.redhat.com/security/updates/classification/#important