Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 38

Vulnerabilities 3

• Critical 9.1
  CVE-2025-22871

  Request smuggling due to acceptance of invalid chunked data in net/http

  The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Packagist Go
  Apr 8, 2025
• High 8.8
  CVE-2025-49520

  Event-driven-ansible: authenticated argument injection in git url in eda project creation

  A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Jun 30, 2025
• High 8.8
  CVE-2025-49521

  Event-driven-ansible: template injection via git branch and refspec in eda projects

  A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access s…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Jun 30, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2358493
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370812
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370817
• article
  https://issues.redhat.com/browse/AAP-42288
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9986.json
• report
  https://access.redhat.com/security/cve/CVE-2025-22871
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22871
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22871
• article
  https://go.dev/cl/652998
• article
  https://go.dev/issue/71988
• article
  https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
• advisory
  https://pkg.go.dev/vuln/GO-2025-3563
• report
  https://access.redhat.com/security/cve/CVE-2025-49520
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49520
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49520
• report
  https://access.redhat.com/security/cve/CVE-2025-49521
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49521
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49521