RHSA-2025:1861HighCVSS 7.3

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.4 (openstack-ansible-core) security update

Published
February 25, 2025
Last Modified
August 24, 2026

🔗 CVE IDs covered (3)

CVE-2024-9902 →CVE-2024-56201 →CVE-2024-56326 →

📋 Description

CVE-2024-9902 — ansible-core: Ansible-core user may read/write unauthorized content CVE-2024-56201 — jinja2: Jinja has a sandbox breakout through malicious filenames CVE-2024-56326 — jinja2: Jinja has a sandbox breakout through indirect reference to format method

🎯 Affected products3

  • Red Hat OpenStack Platform 17.1
  • openstack-ansible-core-0:2.14.2-4.6.el9ost.src as a component of Red Hat OpenStack Platform 17.1
  • openstack-ansible-core-0:2.14.2-4.6.el9ost.x86_64 as a component of Red Hat OpenStack Platform 17.1

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In the play that uses the user module with the key generation option, have a prior task ensuring the public key does not exist for example: - name: avoid user exploit (change name depending on other options used in user task) file: path=/home/{{username}}/.ssh/id_rsa.pub state=absent Workaround: To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.

🔗 References (6)