RHSA-2026:99007: Critical: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Critical: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Other sources
Red Hat Ansible Automation Platform provides an enterprise framework forbuilding, deploying and managing IT automation at scale. IT Managers canprovide top-down guidelines on how automation is applied to individualteams, while automation developers retain the freedom to write tasks thatleverage existing knowledge without the overhead. Ansible AutomationPlatform makes it possible for users across an organization to share, vet,and manage automation content by means of a simple, powerful, and agentlesslanguage.Security Fix(es): automation-controller: GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec (CVE-2026-110858) automation-controller: GitPython: Denial of Service via regular expression backtracking in date parsing (CVE-2026-110856) automation-controller: GitPython: Arbitrary file read via argument injection in branch checkout (CVE-2026-110859) automation-controller: GitPython: Arbitrary code execution via unsafe URL protocol handling (CVE-2026-110857)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.For details about this release, refer to the release notes listed in theReferences section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 4.6.35-1.el9a - Upgrade
Upgrade
redhat/automation-controller-clito a version that resolves this vulnerability.Fixed in 4.6.35-1.el9a - Upgrade
Upgrade
redhat/automation-controller-serverto a version that resolves this vulnerability.Fixed in 4.6.35-1.el9a - Upgrade
Upgrade
redhat/automation-controller-uito a version that resolves this vulnerability.Fixed in 4.6.35-1.el9a - Upgrade
Upgrade
redhat/automation-controller-venv-towerto a version that resolves this vulnerability.Fixed in 4.6.35-1.el9a - Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 4.6.35-1.el8a - Upgrade
Upgrade
redhat/automation-controller-clito a version that resolves this vulnerability.Fixed in 4.6.35-1.el8a - Upgrade
Upgrade
redhat/automation-controller-serverto a version that resolves this vulnerability.Fixed in 4.6.35-1.el8a - Upgrade
Upgrade
redhat/automation-controller-uito a version that resolves this vulnerability.Fixed in 4.6.35-1.el8a - Upgrade
Upgrade
redhat/automation-controller-venv-towerto a version that resolves this vulnerability.Fixed in 4.6.35-1.el8a - Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Which products are listed in the advisory metadata?
The advisory lists Red Hat Ansible Developer and Red Hat Ansible Automation Platform. The update title specifically identifies Ansible Automation Platform 2.5.
Does the available information specify affected versions, exploit prerequisites, or temporary mitigations?
No. The provided data does not identify affected package versions, exploitation requirements, configuration conditions, or mitigations if patching cannot be performed immediately.