Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 10

Vulnerabilities 5

• Critical 9.8
  CVE-2024-53908

  Django SQL injection in HasKey(lhs, rhs) on Oracle

  An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs valu…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Dec 6, 2024
• High 7.5
  CVE-2024-53907

  Django denial-of-service in django.utils.html.strip_tags()

  An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested inc…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Dec 6, 2024
• Medium 6.9
  CVE-2024-11407

  Denial of Service through Data corruption in gRPC-C++

  There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be cor…

  grpc gRPC-C++ grpc grpc Debian Ubuntu Azure Linux
  Nov 26, 2024
• Medium 6.3
  CVE-2024-52304

  aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions

  aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure…

  aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  Nov 18, 2024
• Medium 4.3
  CVE-2024-55565

  Predictable results in nanoid generation when given non-integer values

  nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-optuna-enas katib-suggestion-skopt-enas Debian Ubuntu Wolfi npm
  Dec 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327130
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329287
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329288
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331063
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0340.json
• report
  https://access.redhat.com/security/cve/CVE-2024-11407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-11407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-11407
• article
  https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
• report
  https://access.redhat.com/security/cve/CVE-2024-52304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-52304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-52304
• article
  https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr
• report
  https://access.redhat.com/security/cve/CVE-2024-53907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53907
• article
  https://www.djangoproject.com/weblog/2024/dec/04/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2024-53908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53908
• report
  https://access.redhat.com/security/cve/CVE-2024-55565
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-55565
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-55565
• article
  https://github.com/ai/nanoid/compare/3.3.7...3.3.8
• article
  https://github.com/ai/nanoid/pull/510
• article
  https://github.com/ai/nanoid/releases/tag/5.0.9