rhsa-2025:1954
Vulnerability from csaf_redhat
Published
2025-03-01 13:56
Modified
2025-03-03 17:07
Summary
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Notes

Topic
An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. An issue was found in affected versions of Ansible Automation Platform that enabled a lesser privileged user (even unauthenticated) promotion to a greater privileged user. All Ansible Automation Platform 2.5 customers should upgrade their environments to the latest version as soon as possible. Ansible Automation Platform on Microsoft Azure and Ansible Automation Platform Service on AWS environments have already been patched by Red Hat. Security Fix(es): * automation-gateway: aap-gateway privilege escalation (CVE-2025-1801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update is now available for Red Hat Ansible Automation Platform 2.5\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nAn issue was found in affected versions of Ansible Automation Platform that enabled a lesser privileged user (even unauthenticated) promotion to a greater privileged user.\n\nAll Ansible Automation Platform 2.5 customers should upgrade their environments to the latest version as soon as possible.\n\nAnsible Automation Platform on Microsoft Azure and Ansible Automation Platform Service on AWS environments have already been patched by Red Hat.\n\nSecurity Fix(es):\n\n* automation-gateway: aap-gateway privilege escalation (CVE-2025-1801)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:1954",
            url: "https://access.redhat.com/errata/RHSA-2025:1954",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "2349081",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2349081",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1954.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update",
      tracking: {
         current_release_date: "2025-03-03T17:07:36+00:00",
         generator: {
            date: "2025-03-03T17:07:36+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.3.1",
            },
         },
         id: "RHSA-2025:1954",
         initial_release_date: "2025-03-01T13:56:53+00:00",
         revision_history: [
            {
               date: "2025-03-01T13:56:53+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-03-01T13:56:53+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-03-03T17:07:36+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
                        product: {
                           name: "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
                           product_id: "8Base-Ansible-Automation-Platform-2.5",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
                        product: {
                           name: "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
                           product_id: "9Base-Ansible-Automation-Platform-2.5",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Ansible Automation Platform",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "automation-gateway-0:2.5.20250305-1.el8ap.src",
                        product: {
                           name: "automation-gateway-0:2.5.20250305-1.el8ap.src",
                           product_id: "automation-gateway-0:2.5.20250305-1.el8ap.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway@2.5.20250305-1.el8ap?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-0:2.5.20250305-1.el9ap.src",
                        product: {
                           name: "automation-gateway-0:2.5.20250305-1.el9ap.src",
                           product_id: "automation-gateway-0:2.5.20250305-1.el9ap.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway@2.5.20250305-1.el9ap?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                        product: {
                           name: "automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                           product_id: "automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway@2.5.20250305-1.el8ap?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                        product: {
                           name: "automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                           product_id: "automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway-config@2.5.20250305-1.el8ap?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                        product: {
                           name: "automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                           product_id: "automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway-server@2.5.20250305-1.el8ap?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                        product: {
                           name: "automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                           product_id: "automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway@2.5.20250305-1.el9ap?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                        product: {
                           name: "automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                           product_id: "automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway-config@2.5.20250305-1.el9ap?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
                        product: {
                           name: "automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
                           product_id: "automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/automation-gateway-server@2.5.20250305-1.el9ap?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-0:2.5.20250305-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
               product_id: "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.noarch",
            },
            product_reference: "automation-gateway-0:2.5.20250305-1.el8ap.noarch",
            relates_to_product_reference: "8Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-0:2.5.20250305-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
               product_id: "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.src",
            },
            product_reference: "automation-gateway-0:2.5.20250305-1.el8ap.src",
            relates_to_product_reference: "8Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-config-0:2.5.20250305-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
               product_id: "8Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
            },
            product_reference: "automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
            relates_to_product_reference: "8Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-server-0:2.5.20250305-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8",
               product_id: "8Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
            },
            product_reference: "automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
            relates_to_product_reference: "8Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-0:2.5.20250305-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
               product_id: "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.noarch",
            },
            product_reference: "automation-gateway-0:2.5.20250305-1.el9ap.noarch",
            relates_to_product_reference: "9Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-0:2.5.20250305-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
               product_id: "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.src",
            },
            product_reference: "automation-gateway-0:2.5.20250305-1.el9ap.src",
            relates_to_product_reference: "9Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-config-0:2.5.20250305-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
               product_id: "9Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
            },
            product_reference: "automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
            relates_to_product_reference: "9Base-Ansible-Automation-Platform-2.5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "automation-gateway-server-0:2.5.20250305-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9",
               product_id: "9Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
            },
            product_reference: "automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
            relates_to_product_reference: "9Base-Ansible-Automation-Platform-2.5",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "Chris Meyers",
                  "Elijah DeLee",
               ],
               organization: "Red Hat",
               summary: "This issue was discovered by Red Hat.",
            },
         ],
         cve: "CVE-2025-1801",
         cwe: {
            id: "CWE-362",
            name: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
         },
         discovery_date: "2025-02-28T20:34:52.617000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2349081",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "aap-gateway: aap-gateway privilege escalation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "Red Hat has evaluated this vulnerability. This issue only affects versions AAP 2.5 GA and onwards.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.noarch",
               "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.src",
               "8Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
               "8Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
               "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.noarch",
               "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.src",
               "9Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
               "9Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2025-1801",
            },
            {
               category: "external",
               summary: "RHBZ#2349081",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2349081",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2025-1801",
               url: "https://www.cve.org/CVERecord?id=CVE-2025-1801",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2025-1801",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2025-1801",
            },
         ],
         release_date: "2025-03-01T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-03-01T13:56:53+00:00",
               details: "Red Hat Ansible Automation Platform",
               product_ids: [
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.src",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.src",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:1954",
            },
            {
               category: "workaround",
               details: "Follow the mitigation steps to avoid the flaw from happening. It is recommended to update the product after the fix is available.\n\n\n1) set GRPC_SERVER_MAX_THREADS_PER_PROCESS = 1\n\nThis mitigates problems going FORWARD for the issue because there is only one thread using the ExternalAuth() object instantiated by the parent process. This eliminates the thread safety risk as the worker only processes one request at a time.\n\n2) It is possible that at any time since the install/upgrade of AAP 2.5, that long lived Oauth tokens created in the components with the endpoints could implicate long term access to a different user's identity/privileges. Requests made with these tokens will appear to be from the user for which they were created and are indistinguishable from “valid” tokens that were created by the correct user:\n\n/api/controller/v2/tokens/\n/api/controller/v2/applications/<id>/tokens/\n/api/galaxy/v3/auth/token/\n/api/controller/o/token/\n\nBecause it is likely not feasible to back trace every request that could have generated a token to its original request in the GRPC server, the most conservative and safe path to mitigate this risk would be to invalidate/revoke all existing oauth tokens in the components (hub, controller, eda).",
               product_ids: [
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.src",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.src",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el8ap.src",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el8ap.noarch",
                  "8Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el8ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-0:2.5.20250305-1.el9ap.src",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-config-0:2.5.20250305-1.el9ap.noarch",
                  "9Base-Ansible-Automation-Platform-2.5:automation-gateway-server-0:2.5.20250305-1.el9ap.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "aap-gateway: aap-gateway privilege escalation",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.