Skip to content
OpenAdvisories
High RHSA-2025:18979 2 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published Oct 23, 2025 · Updated Sep 22, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 python3.11-django 0:4.2.25-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 python3.11-django 0:4.2.25-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-gateway 0:2.5.20251022-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-gateway-config 0:2.5.20251022-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-gateway-server 0:2.5.20251022-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 python3.11-django 0:4.2.25-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-gateway 0:2.5.20251022-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-gateway-config 0:2.5.20251022-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-gateway-server 0:2.5.20251022-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 python3.11-django 0:4.2.25-1.el9ap

Vulnerabilities 2

  • High 8.7
    CVE-2025-59343

    tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

    tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4…

    Mafintosh tar-fs sqlpad code-server Debian Ubuntu Wolfi npm
  • Low 3.1
    CVE-2025-59682

    Django vulnerable to partial directory traversal via archives

    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an arch…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2397901
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400450
  • article
    https://issues.redhat.com/browse/AAP-56352
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18979.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-59343
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-59343
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-59343
  • article
    https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
  • article
    https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
  • report
    https://access.redhat.com/security/cve/CVE-2025-59682
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-59682
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-59682