RHSA-2025:4553 - Security Advisory

Topic

An update is now available for Red Hat Ansible Automation Platform 2.5

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

Security Fix(es):

• automation-controller: Potential denial-of-service vulnerability in django.utils.text.wrap() (CVE-2025-26699)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updates and fixes included:

Automation Platform

• Refactored the authenticate() method inside the AuthenticatorPlugin class in legacy_password.py and legacy_sso.py to their common parent LegacyMixin. Added comments to classes and their methods for code clarity (AAP-44460)
• Allow gateway to be installed with a different name for the admin user (AAP-44180)
• Added a grpc_defaults.py file which can contain override information for the GRPC server settings (AAP-44176)
• Changed anchor tag on api html view to button tag so that it doesn't violate semantic rules (AAP-43802)
• Fixed how exceptions are handled on SSO login allowing for error messages to be properly captured (AAP-43369)
• LDAP Authenticator field USER_SEARCH field now properly supports LDAP Unions (AAP-42883)
• Logging level was changed to eliminate X-DAB-JW-TOKEN header messages when logging level is info (AAP-38169)
• Job event streaming is now supported without a websocket connection (AAP-43894)
• Implemented a throttled session refresh mechanism triggered by mouse pointer movements (AAP-43622)
• Resolved occasional flickering in Execution Environment Select dropdown (AAP-43546)
• Added toolbar to search Rulebook Activation History logs (AAP-43338)
• Added an enhanced log viewer for Rulebook Activation Instances similar to the Job Output logger (AAP-43337)
• Fixed an issue where the job output was slow and making it hard to read due to missing parts of the output (AAP-41434)
• Added a notice for users who are waiting on a "running" job to start its playbook execution (AAP-41399)
• Performance improvements were made to authentication method mappings UI (AAP-40963)
• Fix that now allows customers to view output details for filtered job outputs (AAP-38925)
• Added ability to edit an existing rulebook activation (AAP-37299)
• automation-gateway has been updated to 2.5.20250507
• automation-gateway-proxy has been updated to 2.5.10
• python3.11-django-ansible-base has been updated to 2.5.20250507

Automation controller

• Fixed incorrect deprecation warning for "awx.awx.schedule_rrule" (AAP-43474)
• Fixed usage of Django password validator "UserAttributeSimilarityValidator" (AAP-43046)
• Fixed facts so they are no longer unintentionally deleted when the inventory is modified during a Job execution (AAP-39365)
• Implemented GitHub App credential type (AAP-38589)
• automation-controller has been updated to 4.6.12
• receptor has been updated to 1.5.5

Event-Driven Ansible

• Fixed an issue where the drools rule engine used in ansible-rulebook was keeping events that do not match in memory for the default_events_ttl of two hours causing a memory leak (AAP-44899)
• Fixed a bug where the activation fails with message "It will attempt to restart (1/5) in 60 seconds according to the restart policy always" but it does not restart (AAP-43969)
• Fixed a bug special characters such as [] were not allowed in the activation name on OCP deployment (AAP-43742)
• Enhanced the AAP injectors for eda-server to include common platform variables as extra_vars or environment variables if they are specified (AAP-43029)
• Fixed a bug where sometimes the container was not deleted correctly or it misses the last output entries in VM based installations (AAP-42935)
• Added the support for restarting the activation in the rulebook activation module in the eda collection (AAP-42542)
• Allows for AAP aliases to be used to specify eda collections variables to ensure common platform env variables and module variables can be used in the eda collection (AAP-42280)
• Added log tracking id to each log messages labelled as [tid: uuid-pattern] (AAP-42270)
• Added x-request-id to each log message labelled as [rid:uuid-pattern] (AAP-42269)
• EDA Decision Environment validation errors now display under the decision environment text box in the decision environment UI page (AAP-42147)
• If a source plugin terminates we should now be able to see the stack trace with the source file name, the function name and line number (AAP-41774)
• Addressed the cascading delete so that rulebook activations and event streams remain, after the user who created them is deleted (AAP-41769)
• Passed Controller URL is correctly validated (AAP-41575)
• Enables decision environment image to authenticate and pull successfully when using an image registry with a custom port (AAP-41281)
• Relevant settings and versions are emitted in logs when the ansible-rulebook starts in worker mode (AAP-40781)
• ansible-rulebook has been updated to 1.1.6
• automation-eda-controller has been updated to 1.1.8
• python3.11-drools-jpy has been updated to 0.3.10
• python3.11-drools-jpy-jar has been updated to 1.0.7
• python3.11-podman has been updated to 5.4.0

Automation hub

• automation-hub has been updated to 4.10.4
• python3.11-galaxy-importer has been updated to 0.4.29
• python3.11-galaxy-ng has been updated to 4.10.4

Container-based Ansible Automation Platform

• Updated the installer to use ansible.platform collection (AAP-44230)
• Fixed an issue where the automation hub would fail to upload collections due to a missing worker temporary directory (AAP-44166)
• Implemented a playbook to collect sos reports using the inventory file (AAP-42606)
• Added new variable use_archive_compression with default value: true (AAP-41242)
• Added new variables componentName_use_archive_compression for each component with the default value: true (AAP-41242)
• containerized installer setup has been updated to 2.5-13

RPM-based Ansible Automation Platform

• Fixed issue where gateway services were not aligned after restore with the target environment (AAP-44231)
• Updated the installer to use ansible.platform collection (AAP-43465)
• Fixed an issue activating rulebooks caused by missing "Authorization" header (AAP-44700)
• Added compression for archive and database artifacts used in backup/restore (AAP-42055)
• ansible-automation-platform-installer and installer setup have been updated to 2.5-12

Additional changes:

• aap-metrics-utility has been updated to 0.5.0
• ansible-runner has been updated to 2.4.1
• python3.11-dynaconf has been updated to 3.2.10
• python3.11-sqlparse has been updated to 0.5.3

Solution

Red Hat Ansible Automation Platform

Affected Products

• Red Hat Ansible Automation Platform 2.5 for RHEL 9 x86_64
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 s390x
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 ppc64le
• Red Hat Ansible Automation Platform 2.5 for RHEL 9 aarch64
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 x86_64
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 s390x
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 ppc64le
• Red Hat Ansible Automation Platform 2.5 for RHEL 8 aarch64
• Red Hat Ansible Inside 1.3 for RHEL 9 x86_64
• Red Hat Ansible Inside 1.3 for RHEL 9 s390x
• Red Hat Ansible Inside 1.3 for RHEL 9 ppc64le
• Red Hat Ansible Inside 1.3 for RHEL 9 aarch64
• Red Hat Ansible Inside 1.3 for RHEL 8 x86_64
• Red Hat Ansible Inside 1.3 for RHEL 8 s390x
• Red Hat Ansible Inside 1.3 for RHEL 8 ppc64le
• Red Hat Ansible Inside 1.3 for RHEL 8 aarch64
• Red Hat Ansible Developer 1.2 for RHEL 9 x86_64
• Red Hat Ansible Developer 1.2 for RHEL 9 s390x
• Red Hat Ansible Developer 1.2 for RHEL 9 ppc64le
• Red Hat Ansible Developer 1.2 for RHEL 9 aarch64
• Red Hat Ansible Developer 1.2 for RHEL 8 x86_64
• Red Hat Ansible Developer 1.2 for RHEL 8 s390x
• Red Hat Ansible Developer 1.2 for RHEL 8 ppc64le
• Red Hat Ansible Developer 1.2 for RHEL 8 aarch64

Fixes

• BZ - 2348993 - CVE-2025-26699 django: Potential denial-of-service vulnerability in django.utils.text.wrap()

CVEs

• CVE-2025-26699

References

• https://access.redhat.com/security/updates/classification/#moderate