Skip to content
OpenAdvisories
Critical RHSA-2025:23070 1 CVE

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Published Dec 11, 2025 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.6::el9 python3.11-django 0:4.2.26-2.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 automation-controller-venv-tower 0:4.7.6-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.6::el9 python3.11-django 0:4.2.26-2.el9ap

Vulnerabilities 1

  • Critical 9.1
    CVE-2025-64459 Public exploit EPSS 19%

    Potential SQL injection via _connector keyword argument in QuerySet and Q objects

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2412651
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23070.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-64459
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-64459
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-64459
  • article
    https://docs.djangoproject.com/en/dev/releases/security/
  • article
    https://github.com/django/django/commit/c880530ddd4fabd5939bab0e148bebe36699432a
  • article
    https://groups.google.com/g/django-announce
  • article
    https://www.djangoproject.com/weblog/2025/nov/05/security-releases/