CVE-2025-49520
Fixed in a distro release EPSS <1%CVSS 8.8
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat ansible automation platform 2.5 | automation-eda-controller | 0:1.1.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller | 0:1.1.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base | 0:1.1.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base | 0:1.1.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base-services | 0:1.1.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-base-services | 0:1.1.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-event-stream-services | 0:1.1.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-event-stream-services | 0:1.1.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-worker-services | 0:1.1.11-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-eda-controller-worker-services | 0:1.1.11-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy | 0:2.5.10-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-debugsource | 0:2.5.10-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl30 | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl30-debugsource | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl30-server | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl30-server-debuginfo | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl32 | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl32-debugsource | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl32-server | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-openssl32-server-debuginfo | 0:2.6.6-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.5.10-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server-debuginfo | 0:2.5.10-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptor-debuginfo | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform 2.5 | receptor-debugsource | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform 2.5 | receptorctl | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptorctl | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.5.7-2.el8ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.5.7-2.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptorctl | 0:1.5.7-2.el8ap |