Red Hat Ansible Automation Platform 2.5 for RHEL 8 vulnerabilities
65 known vulnerabilities in Red Hat Ansible Automation Platform 2.5 for RHEL 8 from Red Hat. 65 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Missing Authorization
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the i
- 7.1 High severity
Red Hat Ansible Automation Platform 2.5 for…: Incomplete List of Disallowed Inputs
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing a
- 7.6 High severity
Red Hat Ansible Automation Platform 2.5 for…: Incomplete List of Disallowed Inputs
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking l
- 8.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Use of Externally-Controlled Format String
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an ar
- 8.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Improper Neutralization of Input During Web Page Generation
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before c
- 9.1 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Incomplete List of Disallowed Inputs
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes.
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Improper Neutralization of Argument Delimiters in a Command
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote wi
- 7.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Generation of Error Message Containing Sensitive Information
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated again
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Reliance on Untrusted Inputs in a Security Decision
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and
- 7.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the tar
- 7.2 High severity
Red Hat Ansible Automation Platform 2.5 for…: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary
- 7.7 High severity
Red Hat Ansible Automation Platform 2.5 for…: Server-Side Request Forgery
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without va
- 9.6 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Server-Side Request Forgery
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a Ha
- 7.5 High severity
Red Hat Ansible Automation Platform 2.5 for…: Insufficient Verification of Data Authenticity
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication with
- 9.0 Critical severity
Red Hat Ansible Automation Platform 2.5 for…: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrato
- 8.2 High severity
Red Hat Ansible Automation Platform 2.5 for…: Authentication Bypass by Spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated rem
- 9.6 Critical severity
Red Hat Ansible Automation Platform 2.5 for…: Missing Authorization
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with a
- 7.5 High severity
axios: Uncontrolled Resource Consumption
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard
- 7.7 High severity
axios: Improper Control of Generation of Code
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Obj
- 8.7 High severity
axios: Unintended Proxy or Intermediary
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escala
- 8.6 High severity
axios: Server-Side Request Forgery
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv
- 7.5 High severity
axios: Allocation of Resources Without Limits or Throttling
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ra
- 7.5 High severity
axios: Insertion of Sensitive Information Into Sent Data
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usag
- 7.5 High severity
axios: Exposure of Sensitive Information to an Unauthorized Actor
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add
- 7.8 High severity
Red Hat Ansible Automation Platform 2.5 for…: Improper Neutralization of Argument Delimiters in a Command
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git conf
- 7.5 High severity
crypto/x509: Unchecked Input for Loop Condition
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification co
- 7.3 High severity
aiohttp: Deserialization of Untrusted Data
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's
- 7.4 High severity
pyjwt: Improper Authentication
PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to
- 8.2 High severity
net/http: Improper Validation of Unsafe Equivalence in Input
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e
- 7.5 High severity
urllib3: Improper Handling of Highly Compressed Data (Data Amplification)
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Bro
- 7.5 High severity
fast-uri: Interpretation Conflict
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with
- 7.5 High severity
fast-uri: Improper Limitation of a Pathname to a Restricted Directory
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse ont
- 8.3 High severity
Red Hat Ansible Automation Platform 2.5 for…: Authentication Bypass by Primary Weakness
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a r
- 7.2 High severity
Click: Improper Neutralization of Special Elements used in a Command
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vuln
- 9.1 Critical severity
axios: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalat
- 7.5 High severity
Pillow: Uncontrolled Resource Consumption
Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memor
- 9.9 Critical severity
axios: Unintended Proxy or Intermediary
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IP
- 9.8 Critical severity
cryptography: Improper Restriction of Operations within the Bounds of a Memory Buffer
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer ov
- 7.5 High severity
crypto/tls: Allocation of Resources Without Limits or Throttling
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
- 7.5 High severity
crypto/x509: Allocation of Resources Without Limits or Throttling
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and