RHSA-2025:1861HighCVSS 7.3

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1.4 (openstack-ansible-core) security update

Published
February 25, 2025
Last Modified
October 31, 2026

🔗 CVE IDs covered (3)

CVE-2024-9902 →CVE-2024-56201 →CVE-2024-56326 →

📋 Description

CVE-2024-9902 — ansible-core: Ansible-core user may read/write unauthorized content CVE-2024-56201 — jinja2: Jinja has a sandbox breakout through malicious filenames CVE-2024-56326 — jinja2: Jinja has a sandbox breakout through indirect reference to format method

🎯 Affected products3

  • Red Hat OpenStack Platform 17.1
  • openstack-ansible-core-0:2.14.2-4.6.el9ost.src as a component of Red Hat OpenStack Platform 17.1
  • openstack-ansible-core-0:2.14.2-4.6.el9ost.x86_64 as a component of Red Hat OpenStack Platform 17.1

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: In the play that uses the user module with the key generation option, have a prior task ensuring the public key does not exist for example: - name: avoid user exploit (change name depending on other options used in user task) file: path=/home/{{username}}/.ssh/id_rsa.pub state=absent Workaround: To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)