Medium WID-SEC-2025-2432 4 CVEs

Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Published Oct 28, 2025 · Updated Jun 29, 2026 · Revision 8 · de-DE

Vendor: Red Hat Vendor: Ubuntu Product: Ansible Automation Platform Product: Enterprise Linux Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Dateien zu manipulieren, offenzulegen oder Privilegien zu eskalieren.

Product

Red Hat Ansible Automation Platform ist eine End-to-End-Automatisierungsplattform für die Systemkonfiguration, die Softwarebereitstellung und die Orchestrierung erweiterter Workflows.

Vulnerabilities 4

High 8.7

CVE-2025-59343

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4…

Mafintosh tar-fs sqlpad code-server Debian Ubuntu Wolfi npm

Sep 24, 2025
Medium 6.7

CVE-2025-9907

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is…

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.6 for RHEL 9

Feb 27, 2026
Medium 6.7

CVE-2025-9908

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitive internal infrastructure headers (such as X-Trusted-Proxy and X-Envoy-*) and even…

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.6

Feb 27, 2026
Low 3.1

CVE-2025-59682

Django vulnerable to partial directory traversal via archives

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an arch…

djangoproject Django python-django django Debian Ubuntu Alpine PyPI

Oct 1, 2025

Revision history

2026-06-29 #8
Neue Updates von Red Hat aufgenommen
2026-06-16 #7
Neue Updates von Red Hat aufgenommen
2026-06-02 #6
Neue Updates von Ubuntu aufgenommen
2026-03-30 #5
Neue Updates von Red Hat aufgenommen
2025-12-11 #4
Neue Updates von Red Hat aufgenommen
2025-12-10 #3
Neue Updates von Red Hat aufgenommen
2025-11-03 #2
Neue Updates von Red Hat aufgenommen
2025-10-28 #1
Initiale Fassung

References

RedHat Security Advisory vom 2025-10-28
https://access.redhat.com/errata/RHSA-2025:19201
Red Hat Security Advisory RHSA-2025:19221 vom 2025-10-29
https://access.redhat.com/errata/RHSA-2025:19221
Red Hat Security Advisory RHSA-2025:19529 vom 2025-11-04
https://access.redhat.com/errata/RHSA-2025:19529
Red Hat Security Advisory RHSA-2025:23069 vom 2025-12-10
https://access.redhat.com/errata/RHSA-2025:23069
Red Hat Security Advisory RHSA-2025:23131 vom 2025-12-11
https://access.redhat.com/errata/RHSA-2025:23131
Red Hat Security Advisory RHSA-2026:6226 vom 2026-03-31
https://access.redhat.com/errata/RHSA-2026:6226
Ubuntu Security Notice USN-8367-1 vom 2026-06-02
https://ubuntu.com/security/notices/USN-8367-1
Red Hat Security Advisory RHSA-2026:26411 vom 2026-06-16
https://access.redhat.com/errata/RHSA-2026:26411
Red Hat Security Advisory RHSA-2026:33154 vom 2026-06-29
https://access.redhat.com/errata/RHSA-2026:33154