RHSA-2024:11145MediumCVSS 5.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published
December 16, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (2)

CVE-2024-11079 →CVE-2024-11483 →

📋 Description

CVE-2024-11079 — ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core CVE-2024-11483 — automation-gateway: aap-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5

🎯 Affected products72

  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.4.1-2.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.4.1-2.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.4.1-2.el8ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.4.1-2.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.4.1-2.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.4.1-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.4.1-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.4.1-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.4.1-2.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.4.1-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.14-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.14-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.14-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.14-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-rulebook-0:1.1.2-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-rulebook-0:1.1.2-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-rulebook-0:1.1.2-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-rulebook-0:1.1.2-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-test-1:2.16.14-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-test-1:2.16.14-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-eda-controller-0:1.1.3-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-eda-controller-0:1.1.3-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-eda-controller-0:1.1.3-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-eda-controller-0:1.1.3-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-eda-controller-base-0:1.1.3-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-eda-controller-base-0:1.1.3-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-eda-controller-base-services-0:1.1.3-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-eda-controller-base-services-0:1.1.3-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • +42 more not shown

✅ Remediation

Red Hat Ansible Automation Platform Workaround: To mitigate this vulnerability, avoid using the hostvars object to reference content marked as !unsafe. Ensure that all remote data from modules or lookups is properly sanitized and validated before use in playbooks. Additionally, restrict access to inventory files and Ansible playbooks to trusted users to minimize exploitation risks.

🔗 References (5)