Red Hat Security Advisory

RHSA-2025:0341

Red Hat Ansible Automation Platform 2.5 Container Release Update

Released 2025-01-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-25/lightspeed-rhel8

Fixes 4 records

TI-2024-34979 CVE-2024-52304 · GHSA-8495-4g3g-x7pr

aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

LOW 35

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00563 Published 2024-11-18 Partial fix · 3.10.11 CWE-444

TI-2024-10570 CVE-2024-11407 · GHSA-p9rf-64qj-22rw

Denial of Service through Data corruption in gRPC-C++

LOW 31

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00572 Published 2024-11-26 Partial fix CWE-682

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

Jinja has a sandbox breakout through indirect reference to format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

Jinja has a sandbox breakout through malicious filenames

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150