RHSA-2026:79378CriticalCVSS 9.8

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update

Published
October 8, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (13)

CVE-2026-96760 →CVE-2026-102273 →CVE-2026-45820 →CVE-2026-63374 →CVE-2026-69243 →CVE-2026-76219 →CVE-2026-76220 →CVE-2026-78676 →CVE-2026-59893 →CVE-2026-76218 →CVE-2026-76221 →CVE-2026-76222 →CVE-2026-91990 →

📋 Description

CVE-2026-45820 — fflate: fflate: Denial of Service via crafted ZIP archives CVE-2026-59893 — sqlparse: sqlparse: Denial of Service via inefficient SQL parsing CVE-2026-63374 — anyio: AnyIO: TLS certificate spoofing via improper internationalized domain name encoding CVE-2026-69243 — aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade CVE-2026-76218 — gitpython: GitPython: Remote Code Execution via malicious Git hooks CVE-2026-76219 — gitpython: GitPython: Arbitrary File Overwrite via git read-tree option injection CVE-2026-76220 — gitpython: GitPython: Arbitrary command execution via crafted kwargs CVE-2026-76221 — gitpython: GitPython: Arbitrary code execution via config-name injection CVE-2026-76222 — gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names CVE-2026-78676 — gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection CVE-2026-91990 — tornado: Tornado: Denial of Service via memory amplification in multipart parsing CVE-2026-96760 — authlib: authlib: Signature verification bypass via deserialize_json CVE-2026-102273 — pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets

🎯 Affected products65

  • Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:a21805a5c74782894d48fdb289a32bf2418a2baa3afa9fd6a4acfbaf8d3be1d5_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:ce2526f5be80d3cb76d19f210ea9874e7087b7f4ba08b9d06d6127898f6c2c3d_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:34281c236db8517b5cdf13ae4946e4eff87a2af0d28c8cb61f7f323c6b7ecdf0_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-builder-rhel9@sha256:ca6c46eee8df1483a0e976ad5c7d694d327877dc4b271b96857b9fb86c2759ac_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:5118b8171f9ae4b93366f2348ad6bb179b01e44fce795bdeda6aec1b54dea2cc_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-dev-tools-rhel9@sha256:fedb2dcd7eac43b0506af01af1351e46da8b9deb3fc95ae882557c399a37755c_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:44ab79240063392848d923dfacac51782df58d84929b6073418b3bf6c64ac84e_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:88dd1aa9dc5d0eb17547d340fbc575cc3785649cac282aa43c3824340726540b_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:124bd8cc67eab97d91e884418862f8f2d03cbc9e573fd90f7543a1620b69858d_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:a1cc65866ff84ae335a05d4393ad4604b32c11966c34b5242cdf193b438bf7fc_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:44d1624bfa2fa9dcfc4076d2a72905fbc5391cd1b002d9bc509cea30f17d7b20_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:d660f60e5ac9e8d51d1941fb3d2731f898a493ab1eaed1c29bdcba6c33dea526_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:86ceaa26798ce7e2cd94b1e08cc43dce4ecc6598a59d36401f7b680126853a45_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:91484734bbb34018bbc943fbaaf2ac7c7c14ed6931d49e6e1372a81d235c125a_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:93e04b028430e93a897538a973c85de686e8079a0e74249bcda166bb1923ef03_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9@sha256:b661fc788f3da7430d7595c074d3048893e40c9a067396aebcb8e7f39ff3b8c5_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:81751215aa8ffcef572ad0e873378a60614a27849b7becb7b475197e496b7634_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9-operator@sha256:957972981854862fae6b2d8dd0ad4bc903db9237562540473335a0bfbee4e8bf_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:589119fb9bf5f56bdcacdc1c489530883badbf19bf39e7301d818f54b33a6f2e_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:ea96f4fd3ecc131940b68085d051261dda73c0c4a0f485b13e2028159b5a8501_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:3a452b173d9bbc910768571a70e64662058dada1f51e2b65f324236de1d8665c_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:56dfe354c7a660723cb0b10e20f74e93afc82ebdcb5b4b617f24fef702a0ddbd_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-control-plane-rhel9@sha256:5c96f171e3ce1eebec46c03e692b7491c159100613b0baafbd51939742b2dde5_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-control-plane-rhel9@sha256:f379b62f8025a289b8954b9f8a4cd0be39ac6c737e078f2bef39dafd6237309c_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:08cb441fc4dd5b8da1ecbb8a53f3cda9208abe874d284f87fc14fc7bdafc6304_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:394993edbfb979b51acaaad30aa38e7025c4e0f804ce6d3411d5bb4a8b09d199_arm64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:9a159ba22b7ef0cf59146b9a94447f63a35b399792345af0e5bd451440694a8f_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:d253cae013e84b03ebfb9cbe3b43fddb9271a6e5adc0c3a6e85f2d631f752a07_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:c104b9869085faad8ac7cefd1f091683ac58efc4611d3808677b6e8a10ab275e_amd64 as a component of Red Hat Ansible Automation Platform 2.7
  • +35 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade Workaround: There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate's unzip()/unzipSync() APIs. Workaround: Do not pass untrusted or attacker-influenced input as the template parameter (or other forwarded options) to GitPython's Repo.init. Upgrade to GitPython 3.1.58 or later, where the unsafe option forwarding is fixed. Workaround: Do not pass untrusted or attacker-influenced treeish arguments to GitPython's IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree. Upgrade to GitPython 3.1.58 or later, where option injection into `git read-tree` is fixed. Workaround: Do not pass untrusted or attacker-influenced keyword arguments to GitPython's guarded methods such as clone_from, and do not set split_single_char_options=False on untrusted input. Upgrade to GitPython 3.1.58 or later, where the check_unsafe_options bypass is fixed. Workaround: Do not pass untrusted or attacker-influenced git option names to GitPython. Upgrade to GitPython 3.1.58 or later, where option-name (config) injection is fixed. Workaround: There is no mitigation beyond not cloning or initializing git submodules from untrusted repositories. Upgrade to GitPython 3.1.58 or later when it becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (17)