Skip to content
OpenAdvisories
High RHSA-2025:14686 2 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published Aug 31, 2025 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 automation-controller 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 automation-controller-cli 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 python3.11-django 0:4.2.23-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 automation-controller 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 automation-controller-cli 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 python3.11-django 0:4.2.23-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller-cli 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller-server 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller-ui 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller-venv-tower 0:4.6.19-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 python3.11-django 0:4.2.23-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller-cli 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller-server 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller-ui 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller-venv-tower 0:4.6.19-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 python3.11-django 0:4.2.23-1.el9ap

Vulnerabilities 2

  • High 7.7
    CVE-2025-47273 Public exploit

    setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

    setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to ar…

    pypa setuptools kserve-storage-controller datadog-agent-7.77 Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 4.0
    CVE-2025-48432

    Django Improper Output Neutralization for Logs vulnerability

    An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to lo…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2370365
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14686.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-47273
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-47273
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-47273
  • article
    https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
  • article
    https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b
  • article
    https://github.com/pypa/setuptools/issues/4946
  • article
    https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf
  • report
    https://access.redhat.com/security/cve/CVE-2025-48432
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-48432
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-48432
  • article
    http://www.openwall.com/lists/oss-security/2025/06/04/5
  • article
    https://docs.djangoproject.com/en/dev/releases/security/
  • article
    https://groups.google.com/g/django-announce
  • article
    https://www.djangoproject.com/weblog/2025/jun/04/security-releases/