Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 214

Vulnerabilities 6

• Critical 9.1
  CVE-2025-64459 Public exploit EPSS 19%

  Potential SQL injection via _connector keyword argument in QuerySet and Q objects

  An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Nov 5, 2025
• High 7.5
  CVE-2025-58754

  Axios is vulnerable to DoS attack through lack of data size check

  Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapte…

  axios axios katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  Sep 12, 2025
• High 7.5
  CVE-2025-59530

  quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame

  quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a proce…

  quic-go quic-go k3s k3s-static Debian Ubuntu Azure Linux Wolfi Go
  Oct 10, 2025
• Medium 6.7
  CVE-2025-9907

  Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

  A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Feb 27, 2026
• Medium 6.7
  CVE-2025-9908

  Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

  A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and even…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.6
  Feb 27, 2026
• Medium 6.7
  CVE-2025-9909

  Aap-gateway: improper path validation in gateway allows credential exfiltration

  A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. This vulnerability allows credential theft via the creation of misleading routes using a double-slash (//) prefix in the gateway_path. A malicious or socially engine…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Feb 27, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392834
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2392836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2403125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2412651
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23069.json
• report
  https://access.redhat.com/security/cve/CVE-2025-9907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9907
• report
  https://access.redhat.com/security/cve/CVE-2025-9908
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9908
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9908
• report
  https://access.redhat.com/security/cve/CVE-2025-9909
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9909
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9909
• report
  https://access.redhat.com/security/cve/CVE-2025-58754
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-58754
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-58754
• article
  https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593
• article
  https://github.com/axios/axios/pull/7011
• article
  https://github.com/axios/axios/releases/tag/v1.12.0
• article
  https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj
• report
  https://access.redhat.com/security/cve/CVE-2025-59530
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59530
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59530
• article
  https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685
• article
  https://github.com/quic-go/quic-go/pull/5354
• article
  https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw
• report
  https://access.redhat.com/security/cve/CVE-2025-64459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-64459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://github.com/django/django/commit/c880530ddd4fabd5939bab0e148bebe36699432a
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2025/nov/05/security-releases/