TI-2025-16743 CVE-2025-22871 · GHSA-g9pc-8g42-g6vq
Request smuggling due to acceptance of invalid chunked data in net/http
Priority MEDIUM 49
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.
RHSA-2025:9986
Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Released 2025-06-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-eda-controller-1.1.11-1.el8ap, automation-eda-controller-base-1.1.11-1.el8ap, automation-eda-controller-base-services-1.1.11-1.el8ap +6
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-eda-controller-1.1.11-1.el9ap, automation-eda-controller-base-1.1.11-1.el9ap, automation-eda-controller-base-services-1.1.11-1.el9ap +8
Fixes 3 records
TI-2025-31539 CVE-2025-49521 · GHSA-g6ph-9xfv-87c2
Event-driven-ansible: template injection via git branch and refspec in eda projects
Priority MEDIUM 41
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates.
TI-2025-31538 CVE-2025-49520 · GHSA-wxwr-926x-hcq6
Event-driven-ansible: authenticated argument injection in git url in eda project creation
Priority MEDIUM 41
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command.