Skip to content
OpenAdvisories
Medium RHSA-2025:3160 2 CVEs

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published Mar 26, 2025 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 python3.11-django 0:4.2.20-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el8 python3.11-jinja2 0:3.1.6-1.el8ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 python3.11-django 0:4.2.20-1.el9ap
Red Hat · Ansible Automation Platform Developer 2 ansible_automation_platform_developer:2.5::el9 python3.11-jinja2 0:3.1.6-1.el9ap
Red Hat · Ansible Automation Platform Inside 2 ansible_automation_platform_inside:2.5::el8 python3.11-jinja2 0:3.1.6-1.el8ap
Red Hat · Ansible Automation Platform Inside 2 ansible_automation_platform_inside:2.5::el9 python3.11-jinja2 0:3.1.6-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 automation-controller-venv-tower 0:4.6.10-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 python3.11-django 0:4.2.20-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el8 python3.11-jinja2 0:3.1.6-1.el8ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 automation-controller-venv-tower 0:4.6.10-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 python3.11-django 0:4.2.20-1.el9ap
Red Hat · Ansible Automation Platform 2 ansible_automation_platform:2.5::el9 python3.11-jinja2 0:3.1.6-1.el9ap

Vulnerabilities 2

  • Medium 5.4
    CVE-2025-27516

    Jinja sandbox breakout through attr filter selecting format method

    Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerabi…

    pallets jinja nodejs jupyter-base-notebook Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.0
    CVE-2025-26699

    Django Vulnerable to Allocation of Resources Without Limits or Throttling

    An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter are subject to a potential denial-of-service attack when used with very long strings.

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2348993
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2350190
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3160.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-26699
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-26699
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-26699
  • advisory
    https://github.com/advisories/GHSA-p3fp-8748-vqfq
  • article
    https://www.djangoproject.com/security/
  • report
    https://access.redhat.com/security/cve/CVE-2025-27516
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-27516
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-27516
  • article
    https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403
  • article
    https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7