Chapter 9. Patch releases Security, bug fixes, and enhancements for Ansible Automation Platform 2.5 are released as asynchronous erratas. All Ansible Automation Platform erratas are available on the Download Red Hat Ansible Automation Platform page. As a Red Hat Customer Portal user, you can enable errata notifications in the account settings for Red Hat Subscription Management (RHSM). When errata notifications are enabled, you receive notifications through email whenever new erratas relevant to your registered systems are released. Note Red Hat Customer Portal user accounts must have systems registered and consuming Ansible Automation Platform entitlements for Ansible Automation Platform errata notification emails to generate. The patch releases section of the release notes will be updated over time to give notes on enhancements and bug fixes for patch releases of Ansible Automation Platform 2.5. Additional resources For more information about asynchronous errata support in Ansible Automation Platform, see Red Hat Ansible Automation Platform Life Cycle . For information about Common Vulnerabilities and Exposures (CVEs), see What is a CVE? and Red Hat CVE Database . 9.1. Ansible Automation Platform patch release March 12, 2025 This release includes the following components and versions: Release Date Component versions March 12, 2025 Automation controller 4.6.9 Automation hub 4.10.2 Event-Driven Ansible 1.1.6 Container-based installer Ansible Automation Platform (bundle) 2.5-11 Container-based installer Ansible Automation Platform (online) 2.5-11 Receptor 1.5.3 RPM-based installer Ansible Automation Platform (bundle) 2.5-9 RPM-based installer Ansible Automation Platform (online) 2.5-9 CSV Versions in this release: Namespace-scoped Bundle: aap-operator.v2.5.0-0.1740093573 Cluster-scoped Bundle: aap-operator.v2.5.0-0.1740094176 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.1.1. General The ansible.controller collection has been updated to 4.6.9.(AAP-41400) ansible-lint has been updated to 25.1.2.(AAP-38116) Fixed an issue where the bundle installer/ee-supported did not contain the latest collection versions. The following collections have been updated in the ee-supported and the bundle installer: amazon.aws 9.2.0 ansible.windows 2.7.0 arista.eos 10.0.1 cisco.ios 9.1.1 cisco.iosxr 10.3.0 cisco.nxos 9.3.0 cloud.common 4.0.0 cloud.terraform 3.0.0 kubernetes.core 5.1.0 microsoft.ad 1.8.0 redhat.openshift 4.0.1 vmware.vmware 1.10.1 vmware.vmware_rest 4.6.0.(AAP-39960) Fixed an issue where ansible-rulebook did not support by default third party python libraries.(AAP-41341) 9.1.2. Features 9.1.2.1. Event-Driven Ansible Adopts the new credential copy endpoint from the API.(AAP-41384) 9.1.3. Enhancements 9.1.3.1. Event-Driven Ansible Event-Driven Ansible activation logging is now provided via the journald driver.(AAP-39745) Rulebook activations' log message field is now separated into timestamps and message fields.(AAP-39743) Moved ansible.eda collection from de-supported to de-minimal as elements of the collection are required for all Event-Driven Ansible images.(AAP-39749) 9.1.3.2. RPM-based Ansible Automation Platform The setup.sh script now has an option to collect sosreport .(AAP-40085) 9.1.4. Deprecated Deprecated the variables eda_main_url and hub_main_url in favor of the platform gateway proxy URL. Automation hub will now use the platform gateway proxy URL.(AAP-41306) 9.1.5. Bug fixes With this update, the following CVEs have been addressed: CVE-2025-26791 automation-gateway : Mutation XSS in DOMPurify due to improper template literal handling.(AAP-40402) 9.1.5.1. Ansible Automation Platform Fixed an issue in the user collection module where running with state: present would cause a stack trace.(AAP-40887) Fixed an issue that caused updates to SAML authenticators to ignore an updated public certificate provided via UI or API and then fail with the message The certificate and private key do not match .(AAP-40767) Fixed an issue with the ServiceAuthToken destroy method to allow HTTP delete via ServiceAuth to work properly.(AAP-37630) 9.1.5.2. Platform gateway Fixed an issue that would prevent some types of resources from getting synced if there was a naming conflict.(AAP-41241) Fixed an issue where the login failed for users who were members of a team or organization that had a naming conflict.(AAP-41240) Fixed an issue where there would be 401 unauthorized errors thrown at random in the platform gateway UI.(AAP-41165) Fixed an issue where services could not request cloud.redhat.com settings from the platform gateway using ServiceTokenAuth .(AAP-39649) 9.1.5.3. Automation controller Fixed an issue where upgrading was preventing automation controller administrator password to be set for the platform gateway administrator account.(AAP-40839) Fixed an issue where the indirect host counting name recorded the hostname, instead of from the query result.(AAP-41033) Fixed an issue where the OpaClient was not initializing properly after timeouts and retries.(AAP-40997) Fixed an issue where automation controller was missing the service account credentials for analytics.(AAP-40769) Fixed an issue where the ability to enable feature flags via the corresponding setting of the same name was not possible.(AAP-39783) Fixed an issue where the DAB feature flags endpoints were not registered in the automation controller API.(AAP-39778) Fixed an issue where the API was missing a helper method for fetching the service account token from sso.redhat.com .(AAP-39637) 9.1.5.4. Container-based Ansible Automation Platform Fixed an issue where the containerized installer was not creating receptor mesh connections between all automation controller nodes.(AAP-41102) Fixed an issue where a default installation of the containerized Ansible Automation Platform was unable to use container groups.(AAP-40431) Fixed an issue where errors would be hidden during Event-Driven Ansible status validation.(AAP-40021) Fixed an issue where the polkit RPM package was not installed, therefore, not enabling user lingering.(AAP-39860) 9.1.5.5. Event-Driven Ansible Fixed an issue where the EDA_ACTIVATION_DB_HOST environment variable in the eda-initial-data container was missing.(AAP-41270) Fixed an issue with the behavior of the ansible-rulebook and Event-Driven Ansible controller to help when an activation that was started correctly was considered unresponsive and was scheduled for a restart.(AAP-41070) Fixed an issue where editing and copying of rulebook activations in the API were not allowed.(AAP-40254) Fixed an issue where the activation was incorrectly restarted with the error message Missing container for running activation .(AAP-39545) Fixed an issue where the Event-Driven Ansible server did not support PG Notify using certificates.(AAP-39294) Fixed an issue where the user was not required to give a unique user defined name when copying a credential.(AAP-39079) Fixed an issue where the image URL in the collection decision_environment testing was not OCI compliant.(AAP-39064) Fixed an issue where when creating a new team with the same name should have propagated IntegrityError .(AAP-38941) Fixed an issue where decision environment URLs were not validated against OCI specification to ensure successful authentication to the container registry when pulling the image.(AAP-38822) Fixed an issue where the Activation module did not support the copy operation from other activations.(AAP-37306) 9.1.5.6. Receptor Fixed an issue where automation mesh receptor was creating too many inotify processes, and where the user would encounter a too many open files error.(AAP-22605) 9.1.5.7. RPM-based Ansible Automation Platform Fixed an issue where the activation instance logs were missing in RPM deployments.(AAP-40886) Fixed an issue where the managed CA would not correctly assign eligible groups during discovery, during installation, and backup and restore.(AAP-40277) Fixed an issue where during an installation or upgrade, SELinux relabeling was not occurring even if new fcontext rules were added.(AAP-40489) Fixed an issue where the credentials for execution environments and decision environments hosted in automation hub were incorrectly configured.(AAP-40419) Fixed an issue where projects failed to sync due to incorrectly configured credentials for Ansible Automation Platform collections hosted in automation hub.(AAP-40418) 9.1.6. Known Issues In the platform gateway, the tooltip for Projects Create Project - Project Base Path is undefined.(AAP-27631) Deploying platform gateway on FIPS enabled RHEL 9 is currently not supported.(AAP-39146) 9.2. Ansible Automation Platform patch release March 01, 2025 This release includes the following components and versions: Release date Component versions March 01, 2025 Automation controller 4.6.8 Automation hub 4.10.1 Event-Driven Ansible 1.1.4 Container-based installer Ansible Automation Platform (bundle) 2.5-10.2 Container-based installer Ansible Automation Platform (online) 2.5-10 Receptor 1.5.1 RPM-based installer Ansible Automation Platform (bundle) 2.5-8.3 RPM-based installer Ansible Automation Platform (online) 2.5-8 CSV versions in this release: Namespace-scoped bundle: aap-operator.v2.5.0-0.1740773472 Cluster-scoped bundle: aap-operator.v2.5.0-0.1740774104 Important An issue was found in affected versions of Ansible Automation Platform that enabled a lesser privileged user (even unauthenticated) promotion to a greater privileged user. All Ansible Automation Platform 2.5 customers should upgrade their environments to the latest version as soon as possible to resolve this issue. Ansible Automation Platform on Microsoft Azure and Ansible Automation Platform Service on AWS environments are already patched by Red Hat. The following bug fixes have been implemented in this release of Ansible Automation Platform: 9.2.1. Bug fixes 9.2.1.1. CVE With this update, the following CVE has been addressed: CVE-2025-1801 automation-gateway : aap-gateway privilege escalation. (AAP-41180) 9.2.1.2. Platform gateway Fixed an issue that caused the API to randomly return 401 errors. (AAP-41054) 9.3. Ansible Automation Platform patch release February 25, 2025 This release includes the following components and versions: Release Date Component versions February 25, 2025 Automation controller 4.6.8 Automation hub 4.10.1 Event-Driven Ansible 1.1.4 Container-based installer Ansible Automation Platform (bundle) 2.5-10.1 Container-based installer Ansible Automation Platform (online) 2.5-10 Receptor 1.5.1 RPM-based installer Ansible Automation Platform (bundle) 2.5-8.2 RPM-based installer Ansible Automation Platform (online) 2.5-8 CSV Versions in this release: Namespace-scoped Bundle: aap-operator.v2.5.0-0.1740093573 Cluster-scoped Bundle: aap-operator.v2.5.0-0.1740094176 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.3.1. Enhancements 9.3.1.1. Platform gateway Previously gateway_proxy_url was used for the proxy health check, but is no longer used in favor of the ENVOY_HOSTNAME setting.(AAP-39907) 9.3.1.2. Event-Driven Ansible In the credential type schema the format field can be set to binary_base64 to specify a file should be loaded as a binary file.(AAP-36581) Sample Credential Type Schema Inputs Configuration fields: id: keytab type: string label: Kerberos Keytab file format: binary_base64 secret: true help_text: Please select a Kerberos Keytab file multiline: true 9.3.2. Bug fixes 9.3.2.1. Ansible Automation Platform Fixed an issue where the subscription entitlement expiration notification was visible, even when the subscription was active.(AAP-39982) Fixed an issue where upon UI reload/refresh, logs of a running job before the refresh would not appear until new logs were generated from the playbook.(AAP-38924) Fixed an issue when the customer was unable to scale down replicas to put Ansible Automation Platform into idle mode.(AAP-39492) After launching the Workflow Job Template , the launched job for a job template node in the workflow should contain the job_tags and skip_tags that were specified in the launch prompt step.(AAP-40395) Fixed an issue where the user was not able to create a members role in Ansible Automation Platform 2.5.(AAP-37626) Fixed an issue where a custom image showed Base64 encoded data.(AAP-26984) Fixed an issue where a custom logo showed Base64 encoded data.(AAP-26909) Fixed an issue that restricted users from executing jobs for which they had the correct permissions.(AAP-40398) Fixed an issue where the workflow job template node extra vars were not saved.(AAP-40396) Fixed an issue where the Creating and using execution environments guide had the incorrect ansible-core version.(AAP-40390) Fixed an issue where you were not able to create a members role in Ansible Automation Platform 2.5.(AAP-40698) Fixed an issue where the initial login to any of the services from platform gateway could result in the user being given access to the wrong account.(AAP-40617) Fixed an issue where the service owned resources were not kept in sync with the platform gateway allowing for duplicate name values on user login.(AAP-40616) Fixed an issue where users, organizations, and teams, became permanently out of sync if any user, organization, or team, was deleted from the platform gateway.(AAP-40615) Fixed an issue where automation hub would fail to run the sync task if any users were deleted from the system.(AAP-40613) 9.3.2.2. Platform gateway Fixed an issue where ping and status checks with resolvable, but nonresponding, URLs could cause all platform gateway uwsgi workers to hang until all were exhausted. The new settings are PING_PAGE_CHECK_TIMEOUT and PING_PAGE_CHECK_IGNORE_CERT .(AAP-39907) 9.3.2.3. Event-Driven Ansible Fixed an issue where credentials could be copied in AAP but could not be copied in Event-Driven Ansible.(AAP-35875) 9.3.2.4. Known Issues In the platform gateway, the tooltip for Projects Create Project - Project Base Path is undefined.(AAP-27631) Deploying the platform gateway on FIPS enabled RHEL 9 is currently not supported.(AAP-39146) 9.4. Ansible Automation Platform patch release February 13, 2025 This release includes the following components and versions: Release Date Component versions February 13, 2025 Automation controller 4.6.8 Automation hub 4.10.1 Event-Driven Ansible 1.1.4 Container-based installer Ansible Automation Platform (bundle) 2.5-10 Container-based installer Ansible Automation Platform (online) 2.5-10 Receptor 1.5.1 RPM-based installer Ansible Automation Platform (bundle) 2.5-8.1 RPM-based installer Ansible Automation Platform (online) 2.5-8 CSV Versions in this release: Namespace-scoped Bundle: aap-operator.v2.5.0-0.1738808953 Cluster-scoped Bundle: aap-operator.v2.5.0-0.1738809624 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.4.1. New Features 9.4.1.1. Ansible Automation Platform Keycloak now allows for the configuration of the claim key/name for the field containing a user's group membership returned in the ID token and/or user info data. This can be configured by setting the GROUPS_CLAIM configuration value on a per-authenticator plugin basis as was done for the OIDC plugin.(AAP-38720) 9.4.2. Enhancements 9.4.2.1. General The ansible.controller collection has been updated to 4.6.8.(AAP-39848) ansible.platform collection has been updated to 2.5.20250213.(AAP-39740) ansible.eda collection has been updated to 2.4.0.(AAP-39577) 9.4.2.2. Ansible Automation Platform It is now possible to configure automation hub without Redis PVC.(AAP-39600) 9.4.2.3. Automation controller This release sees the addition of client_id and client_secret fields to the Insights credential to support service accounts via console.redhat.com.(AAP-36565) You are now able to specify the input for the client_id and client_secret for the insights credential via the awx.awx.credential_type module.(AAP-37441) Updated awxkit by adding service account support for Insights credential type, specifically adding the fields client_id and client_secret to credential_input_fields .(AAP-39352) 9.4.2.4. Automation execution environments The file command has been added to ee-minimal and ee-supported container images.(AAP-40009) 9.4.3. Bug fixes 9.4.3.1. Migration Fixed an issue where after upgrading Ansible Automation Platform from 2.4 to 2.5, many of the surveys that had multiple choice options displayed a blank space in the drop down menu.(AAP-35093) 9.4.3.2. Ansible Automation Platform Fixed a bug in the collections token module where it was unable to find an application if multiple organizations had the same application name.(AAP-38625) Fixed an issue where upgrading Ansible Automation Platform 2.5 caused an occasional internal server error for all users with Event-Driven Ansible and Automation hub post upgrade.(AAP-39293) Fixed an issue where the administrator was not allowed to configure auto migration of legacy authenticators.(AAP-39949) Fixed an issue where there were two launch/relaunch icons displayed from the jobs list for failed jobs.(AAP-38483) Fixed an issue where the Schedules Add wizard returned a RequestError Not Found .(AAP-37909) Fixed an issue where the EC2 Inventory Source type required credentials, which is not necessary when using IAM instance profiles.(AAP-37346) Fixed an issue when attempting to assign the Automation Decisions - Organization Admin role to a user in an organization resulted in the error, Not managed locally, use the resource server instead . Administrators can now be added by using the Organization Administrators tab.(AAP-37106) Fixed an issue where when updating a workflow node, the Job Tags were lost and Skip Tags were not saved.(AAP-35956) Fixed an issue where new users who logged in with legacy authentication were not merged when switching to Gateway authentication.(AAP-40120) Fixed an issue where the user was unable to link legacy SSO accounts to Gateway.(AAP-40050) Fixed an issue where updating Ansible Automation Platform to 2.5 caused an Internal Service Error for all users with Event-Driven Ansible and Automation hub post upgrade. The migration process will now detect and fix users who were created in services via JWT auth and improperly linked to the service instead of the platform gateway.(AAP-39914) 9.4.3.3. Ansible Automation Platform Operator Fixed an issue where AnsibleWorkflow custom resources would not parse and utilize extra_vars if specified.(AAP-39005) 9.4.3.4. Automation controller Fixed an issue where when an Azure credential was created using awxkit , the creation failed because the parameter client_id was added to the input fields while the API was not expecting it.(AAP-39846) Fixed an issue where the job schedules were running at incorrect times when that schedule's start time fell within a Daylight Saving Time period.(AAP-39826) 9.4.3.5. Automation hub Fixed an issue where the use of empty usernames and passwords when creating a remote registry was not allowed.(AAP-26462) 9.4.3.6. Container-based Ansible Automation Platform Fixed an issue where the containerized installer had no preflight check for the Postgres version of an external database.(AAP-39727) Fixed an issue where the containerized installer could not register other peers in the database.(AAP-39470) Fixed an issue where there was a missing installation user UID check.(AAP-39393) Fixed an issue where Postgresql connection errors would be hidden during its configuration.(AAP-39389) Fixed an issue in the preflight check regression when the TLS private key provided is not an RSA type.(AAP-39816) 9.4.3.7. Event-Driven Ansible Fixed an issue where the Generate extra vars button did not handle file/env injected credentials.(AAP-36003) 9.4.3.8. Known Issues In the platform gateway, the tooltip for Projects Create Project - Project Base Path is undefined.(AAP-27631) Deploying the platform gateway on FIPS enabled RHEL 9 is currently not supported.(AAP-39146) 9.5. Ansible Automation Platform patch release January 29, 2025 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.5.1. Enhancements 9.5.1.1. Ansible Automation Platform Using PostgreSQL TLS certificate authentication with an external database is now available.(AAP-38400) 9.5.1.2. Event-Driven Ansible The ansible.eda collection has been updated to 2.3.1.(AAP-39057) Users are now able to create a new Event-Driven Ansible credential by copying an existing one.(AAP-39249) Added support for file and env injectors for credentials.(AAP-39091) 9.5.1.3. RPM-based Ansible Automation Platform Implemented certificate authentication support (mTLS) for external databases. Postgresql TLS certificate authentication is available for external databases. Postgresql TLS certificate authentication can be turned on/off (off by default for backward compatibility). Each component, automation controller, Event-Driven Ansible, platform gateway, and automation hub, now provides off the shelf (OTS) TLS certificate and key files (mandatory).(AAP-38400) 9.5.2. Bug fixes 9.5.2.1. CVE With this update, the following CVEs have been addressed: CVE-2024-56326 python3.11-jinja2 : Jinja has a sandbox breakout through indirect reference to format method.(AAP-38852) CVE-2024-56374 ansible-lightspeed-container : Potential denial-of-service vulnerability in IPv6 validation.(AAP-38647) CVE-2024-56374 python3.11-django : potential denial-of-service vulnerability in IPv6 validation.(AAP-38630) CVE-2024-53907 python3.11-django : Potential denial-of-service in django.utils.html.strip_tags().(AAP-38486) CVE-2024-56201 python3.11-jinja2 : Jinja has a sandbox breakout through malicious filenames.(AAP-38331) CVE-2024-56374 automation-controller : Potential denial-of-service vulnerability in IPv6 validation.(AAP-38648) CVE-2024-56201 automation-controller : Jinja has a sandbox breakout through malicious filenames.(AAP-38081) CVE-2024-56326 automation-controller : Jinja has a sandbox breakout through indirect reference to format method.(AAP-38058) 9.5.2.2. Automation controller Fixed an issue where the order of source inventories was not respected by the collection ansible.controller .(AAP-38524) Fixed an issue where an actively running job on an execution node may have had its folder deleted by a system task. This fix addresses some Failed to JSON parse a line from worker stream type errors.(AAP-38137) 9.5.2.3. Container-based Ansible Automation Platform The inventory file variable postgresql_admin_username is no longer required when using an external database. If you do not have database administrator credentials, you can supply the database credentials for each component in the inventory file instead.(AAP-39077) 9.5.2.4. Event-Driven Ansible Fixed an issue where the application version in the openapi spec was incorrectly set.(AAP-38392) Fixed an issue where activations were not properly updated in some scenarios with a high load of the system. (AAP-38374) Fixed an issue where users were unable to filter Rule Audits by rulebook activation name.(AAP-39253) Fixed an issue where the input field of the injector configuration could not be empty.(AAP-39086) 9.5.2.5. RPM-based Ansible Automation Platform Fixed an issue where setting automationedacontroller_max_running_activations could cause the installer to fail. (AAP-38708) Fixed an issue where the platform gateway services are not restarted when a dependency changes.(AAP-38918) Fixed an issue where the platform gateway could not be setup with custom SSL certificates.(AAP-38985) 9.6. Ansible Automation Platform patch release January 22, 2025 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.6.1. Enhancements 9.6.1.1. Ansible Automation Platform Legacy Auth SSO URL settings are now customizable if needed for gateway, controller, and hub overrides passed on the Ansible Automation Platform CR if provided. This is mainly useful if you are using a custom ingress controller.(AAP-37364) 9.6.2. Bug fixes 9.6.2.1. Ansible Automation Platform Fixed an issue where there was a service_id mismatch between gateway and Event-Driven Ansible which was causing activation rulebooks to fail.(AAP-38172) Note This fix applies to OpenShift Container Platform only. 9.7. Ansible Automation Platform patch release January 15, 2025 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.7.1. Enhancements 9.7.1.1. Ansible Automation Platform With this update, the ansible.controller collection has been updated to 4.6.6.(AAP-38443) Enhanced the status API , /api/gateway/v1/status/ , from the services property within the JSON to an array. Consumers of this API can still request the format with a URL query parameter service_keys=true .(AAP-37903) 9.7.1.2. Ansible Automation Platform Operator Added the ability to configure topology_spread_constraints, `node_selector, and `tolerations for gateway deployments. (AAP-37193) 9.7.1.3. Container-based Ansible Automation Platform TLS certificate and key files are now validated during the preflight role execution. If the TLS certificate file is provided then the TLS key file must be provided. If the TLS key file is provided then the TLS certificate file must be provided. Both TLS certificate and key modulus should match.(AAP-37845) 9.7.2. Bug fixes 9.7.2.1. CVE With this update, the following CVEs have been addressed: CVE-2024-52304 python3.11-aiohttp : aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions.(AAP-36192) CVE-2024-55565 automation-gateway : nanoid mishandles non-integer values.(AAP-37168) CVE-2024-53908 automation-controller : Potential SQL injection in HasKey(lhs, rhs) on Oracle.(AAP-36769) CVE-2024-53907 automation-controller : Potential denial-of-service in django.utils.html.strip_tags() .(AAP-36756) CVE-2024-11407 automation-controller : Denial-of-Service through data corruption in gRPC-C++ .(AAP-36745) CVE-2024-52304 ansible-lightspeed-container : aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions.(AAP-36185) CVE-2024-56201 ansible-lightspeed-container : Jinja has a sandbox breakout through malicious filenames.(AAP-38079) CVE-2024-56326 ansible-lightspeed-container : Jinja has a sandbox breakout through indirect reference to format method.(AAP-38056) CVE-2024-11407 ansible-lightspeed-container : Denial-of-Service through data corruption in gRPC-C++ .(AAP-36744) 9.7.2.2. Red Hat Ansible Automation Platform Fixed not found error that occurred occasionally when navigating through the form wizards.(AAP-37495) Fixed an issue where installing ansible-core no longer installs python3-jmespath on Red Hat Enterprise Linux 8.(AAP-18251) Fixed an issue where ID_KEY attribute was improperly used to determine the username field in social auth pipelines.(AAP-38300) Fixed an issue where authenticator could create a userid and return a non-viable authenticator_uid .(AAP-38021) Fixed an issue where a private key was displayed in plain text when downloading the OpenAPI schema file.(AAP-37843) Note This was not the private key used by gateway, but a random default key. 9.7.2.3. Automation controller Fixed an issue that did not allow sending job_lifecycle logs to external aggregators.(AAP-37537) Fixed an issue where there was a date comparison mismatch for traceback from host_metric_summary_monthly task.(AAP-37487) Fixed an issue where the scheduled jobs with count set to a non-zero value would run unexpectedly. (AAP-37290) Fixed an issue where a project's requirements.yml could revert to a prior state in a cluster. (AAP-37228) Fixed an issue where there would be an occasional error creating the event partition table before starting a job, when a large number of jobs were launched quickly. (AAP-37227) Fixed an issue where temporary receptor files were not cleaned up after a job completed on nodes. (AAP-36904) Fixed an issue where POST to /api/controller/login/ via the gateway resulted in a fatal response.(AAP-33911) Fixed an issue when a job template was launched, the named URL returned a 404 error code.(AAP-37025) 9.7.2.3.1. Container-based Ansible Automation Platform Fixed an issue where the receptor TLS certificate content was not validated during the preflight role execution ensuring that the x509 Subject Alt Name (SAN) field contains the required ISO Object Identifier (OID) 1.3.6.1.4.1.2312.19.1. (AAP-37880) Fixed an issue where the Postgresql SSL mode variables for controller, Event-Driven Ansible, gateway and automation hub were not validated during the preflight role execution. (AAP-37352) Fixed an issue where the Ansible Automation Platform containerized setup installation would upload collections when inventory growth in the AIO installation was used.(AAP-38372) Fixed an issue where the throttle capacity of controller in an AIO installation would allow for performance degradation.(AAP-38207) 9.7.2.4. RPM-based Ansible Automation Platform Fixed an issue where adding a new automation hub host to an upgraded environment has caused the installation to fail. (AAP-38204) Fixed an issue where the link to the documents in the installer README.md was broken. (AAP-37627) Fixed an issue where the Gateway API status on Event-Driven Ansible proxy component returned 404 errors. (AAP-32816) 9.8. Ansible Automation Platform patch release December 18, 2024 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.8.1. Enhancements 9.8.1.1. Ansible Automation Platform Added help text to all missing fields in Ansible Automation Platform gateway and django-ansible-base . (AAP-37068) Consistently formatted sentence structure for help_text , and provided more context in the help text where it was vague.(AAP-37016) Added dynamic preferences for usage by Automation Analytics.(AAP-36710) INSIGHTS_TRACKING_STATE : Enables the service to gather data on automation and send it to Automation Analytics. RED_HAT_CONSOLE_URL : This setting is used to to configure the upload URL for data collection for Automation Analytics. REDHAT_USERNAME : Username used to send data to Automation Analytics. REDHAT_PASSWORD : Password for the account used to send data to Automation Analytics. SUBSCRIPTIONS_USERNAME : Username is used to retrieve subscription and content information. SUBSCRIPTIONS_PASSWORD : Password is used to retrieve subscription and content information. AUTOMATION_ANALYTICS_GATHER_INTERVAL : interval in seconds at which Automation Analytics gathers data. Added an enabled flag for turning authenticator maps on or off. (AAP-36709) aap-metrics-utility has been updated to 0.4.1. (AAP-36393) Added the setting trusted_header_timeout_in_ns to timegate X_TRUSTED_PROXY_HEADER validation in the django-ansible-base libraries used by Ansible Automation Platform components. (AAP-36712) 9.8.1.2. Documentation updates With this update, the Ansible Automation Platform Operator growth topology and Ansible Automation Platform Operator enterprise topology have been updated to include s390x (IBM Z) architecture test support. 9.8.1.3. Event-Driven Ansible Extended the scope of the log_level and debug settings. (AAP-33669) A project can now be synced with the Event-Driven Ansible collection modules. (AAP-32264) In the Rulebook activation create form, selecting a project is now required before selecting a rulebook.(AAP-28082) The Create credentials button is now visible irrespective of whether there are any existing credentials or not.(AAP-23707) 9.8.2. Bug fixes 9.8.2.1. General Fixed an issue where django-ansible-base fallback cache kept creating a tmp file even if the LOCATION was set to another path.(AAP-36869) Fixed an issue where the OIDC authenticator was not allowed to use the JSON key to extract user groups, or for a user to be modified via the new GROUPS_CLAIM configuration setting.(AAP-36716) With this update, the following CVEs have been addressed: CVE-2024-11079 ansible-core : Unsafe Tagging Bypass via hostvars Object in Ansible-Core.(AAP-35563) CVE-2024-53908 ansible-lightspeed-container : Potential SQL injection in HasKey(lhs, rhs) on Oracle.(AAP-36767) CVE-2024-53907 ansible-lightspeed-container : Potential denial-of-service in django.utils.html.strip_tags() .(AAP-36755) CVE-2024-11483 which allowed users to escape the scope of their personal access OAuth2 tokens, from read-scoped to read-write-scoped, in the gateway.(AAP-36261) 9.8.2.2. Red Hat Ansible Automation Platform Fixed an issue where when role user assignments were queried in the platform UI, the query is successful about 75% of the time.(AAP-36872) Fixed an issue where the user was unable to filter job templates by label in Ansible Automation Platform 2.5.(AAP-36540) Fixed an issue where it was not possible to open a job template after removing the user that created the template.(AAP-35820) Fixed an issue where the inventory source update failed, and did not allow selection of the inventory file.(AAP-35246) Fixed an issue where the Login Redirect Override setting was missing and not functioning as expected in Ansible Automation Platform 2.5.(AAP-33295) Fixed an issue where users were able to select a credential that required a password when defining a schedule.(AAP-32821) Fixed an issue where the job output did not show unless you switched tabs. This also fixed other display issues.(AAP-31125) Fixed an issue where adding a new Automation Decision role to a team did not work from the Access Management Teams navigation path.(AAP-31873) Fixed an issue where migration was missing from Ansible Automation Platform.(AAP-37015) Fixed an issue where the gateway OAuth token was not encrypted at rest.(AAP-36715) Fixed an issue where the API forces the user to save a service with an API port even if one does not exist.(AAP-36714) Fixed an issue where the Gateway did not properly interpret SAML attributes for mappings.(AAP-36713) Fixed an issue where non-self-signed certificate+key pairs were allowed to be used in SAML authenticator configurations.(AAP-36707) Fixed an issue where the login page was not redirecting to /api/gateway/v1 if a user was already logged in.(AAP-36638) 9.8.2.3. Ansible automation hub When configuring an Ansible Remote to sync collections from other servers, a requirements file is only required for syncs from Galaxy, and optional otherwise. Without a requirements file, all collections are synced.(AAP-31238) 9.8.2.3.1. Container-based Ansible Automation Platform Fixed an issue that allowed automation controller nodes to override the receptor_peers variable. (AAP-37085) Fixed an issue where the containerized installer ignored receptor_type for automation controller hosts and always installed them as hybrid.(AAP-37012) Fixed an issue where Podman was not present in the task container, and the cleanup image task failed.(AAP-37011) Fixed an issue where only one automation controller node was configured with Execution/Hop node peers rather than all automation controller nodes.(AAP-36851) Fixed an issue where the automation controller services lost connection to the database, where the containers are stopped and the systemd unit does not try to restart.(AAP-36850) Fixed an issue where receptor_type and receptor_protocol variables validation checks were skipped during the preflight role execution.(AAP-36857) 9.8.2.4. Event-Driven Ansible Fixed an issue where the url field of the event stream was not updated if EDA_EVENT_STREAM_BASE_URL setting changed. (AAP-33819) Fixed an issue where Event-Driven Ansible and automation controller fields were pre-populated with gateway credentials when secret: true is set on custom credentials.(AAP-33188) Fixed an issue where the bulk removal of selected role permissions disappeared when more than 4 permissions were selected.(AAP-28030) Fixed an issue where Enabled options had its own scrollbar on the Rulebook Activation Details page.(AAP-31130) Fixed an issue where the status of an activation was occasionally inconsistent with the status of the latest instance after a restart.(AAP-29755) Fixed an issue where importing a project from a non-existing branch resulted in the completed state instead of a Failed status.(AAP-29144) Fixed an issue with respect to the custom credential types where if the user clicked The generate extra vars before the fields: key in the input configuration it would create an empty line that is uneditable.(AAP-28084) Fixed an issue where the project sync would not fail on an empty or unstructured git repository.(AAP-35777) Fixed an issue where rulebook validation import/sync fails when a rulebook has a duplicated rule name.(AAP-35164) Fixed an issue where the Event Driven Ansible API allowed a credential's type to be changed.(AAP-34968) Fixed an issue where a previously failed project could be accidentally changed to completed after a resync.(AAP-34744) Fixed an issue where no message was recorded when a project did not contain any rulebooks.(AAP-34555) Fixed an issue where the name for credentials in the rulebook activation form field was not updated.(AAP-34123) Updated the message for the rulebook activation/event streams for better clarity.(AAP-33485) Fixed an issue where the source plugin was not able to use the env vars to establish a successful connection to the remote source.(AAP-35597) Fixed an issue in the collection where the activation module failed with a misleading error message if the rulebook, project, decision environment, or organization, could not be found.(AAP-35360) Fixed an issue where the validation a host specified as part of a container registry credential did not conform to container registry standards. The specified host was previously able to use a non-syntactically valid host (name or net address) and optional port value (<valid-host>[:<port>]) . The validation is now applied when creating a credential as well as when modifying an existing credential regardless of fields being modified.(AAP-34969) Fixed an issue whereby multiple Red Hat Ansible Automation Platform credentials were being attached to activations.(AAP-34025) Fixed an issue where there was an erroneous dependency on the existence of an organization named Default .(AAP-33551) Fixed an issue where occasionally an activation is reported as running, before it is ready to receive events.(AAP-31225) Fixed an issue where the user could not edit auto-generated injector vars while creating Event-Driven Ansible custom credentials.(AAP-29752) Fixed an issue where in some cases the file_watch source plugin in an Event-Driven Ansible collection raised the QueueFull exception.(AAP-29139) Fixed an issue where the Event-Driven Ansible database increased in size continuously, even if the database was unused. Addend the purge_record script to clean up outdated database records.(AAP-30684) 9.9. Ansible Automation Platform patch release December 3, 2024 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.9.1. Enhancements 9.9.1.1. Ansible Automation Platform Red Hat Ansible Lightspeed has been updated to 2.5.241127.(AAP-35307) redhat.insights Ansible collection has been updated to 1.3.0.(AAP-35161) ansible.eda collection has been updated to 2.2.0 in execution environment and decision environment images.(AAP-3398) 9.9.1.2. Ansible Automation Platform Operator With this update, you can set PostgreSQL SSL/TLS mode to verify-full or verify-ca with the proper sslrootcert configuration in the automation hub Operator.(AAP-35368) 9.9.1.3. Container-based Ansible Automation Platform With this update, ID and Image fields from a container image are used instead of Digest and ImageDigest to trigger a container update.(AAP-36575) With this update, you can now update the registry URL value in Event-Driven Ansible credentials.(AAP-35085) With this update, the kernel.keys.maxkeys and kernel.keys.maxbytes settings are increased on systems with large memory configuration.(AAP-34019) Added ansible_connection=local to the inventory-growth file and clarified its usage.(AAP-34016) 9.9.1.4. Documentation updates With this update, the Container growth topology and Container enterprise topology have been updated to include s390x (IBM Z) architecture test support.(AAP-35969) 9.9.1.5. RPM-based Ansible Automation Platform With this update, you can now update the registry URL value in Event-Driven Ansible credentials.(AAP-35162) 9.9.2. Bug fixes 9.9.2.1. General With this update, the following CVEs have been addressed: CVE-2024-52304 automation-controller : aiohttp vulnerable to request smuggling due to wrong parsing of chunk extensions. 9.9.2.2. Ansible Automation Platform Operator With this update, missing Ansible Automation Platform Operator custom resource definitions (CRDs) are added to the aap-must-gather container image.(AAP-35226) Disabled platform gateway authentication in the proxy configuration to prevent HTTP 502 errors when the control plane is down.(AAP-36527) The Red Hat favicon is now correctly displayed on automation controller and Event-Driven Ansible API tabs.(AAP-30810) With this update, the automation controller admin password is now reused during upgrade from Ansible Automation Platform 2.4 to 2.5.(AAP-35159) Fixed undefined variable ( _controller_enabled ) when reconciling an AnsibleAutomationPlatformRestore . Fixed automation hub Operator pg_restore error on restores due to a wrong database secret being set.(AAP-35815) 9.9.2.3. Automation controller Updated the minor version of uWSGI to obtain updated log verbiage.(AAP-33169) Fixed job schedules running at the wrong time when the rrule interval was set to HOURLY or MINUTELY .(AAP-36572) Fixed an issue where sensitive data was displayed in the job output.(AAP-35584) Fixed an issue where unrelated jobs could be marked as a dependency of other jobs.(AAP-35309) Included pod anti-affinity configuration on default container group pod specification to optimally spread workload.(AAP-35055) 9.9.2.4. Container-based Ansible Automation Platform With this update, you cannot change the postgresql_admin_username value when using a managed database node.(AAP-36577) Added update support for PCP monitoring role. Disabled platform gateway authentication in the proxy configuration to prevent HTTP 502 errors when the control plane is down. With this update, you can use dedicated nodes for the Redis group. Fixed an issue where disabling TLS on platform gateway would cause installation to fail. Fixed an issue where disabling TLS on platform gateway proxy would cause installation to fail. Fixed an issue where platform gateway uninstall would leave container systemd unit files on disk. Fixed an issue where the automation hub container signing service creation failed when hub_collection_signing=false but hub_container_signing=true . Fixed an issue with the HOME environment variable for receptor containers which would cause a "Permission denied" error on the containerized execution node. Fixed an issue where not setting up the GPG agent socket properly when many hub nodes are configured, resulted in not creating a GPG socket file in /var/tmp/pulp . With this update, you can now change the platform gateway port value after the initial deployment. 9.9.2.5. Receptor Fixed an issue that caused a Receptor runtime panic error. 9.9.2.6. RPM-based Ansible Automation Platform Fixed an issue where the metrics-utility command failed to run after updating automation controller. Fixed the owner and group permissions on the /etc/tower/uwsgi.ini file. Fixed an issue where not having eda_node_type defined in the inventory file would result in backup failure. Fixed an issue where not having routable_hostname defined in the inventory file would result in a restore failure. With this update, the inventory-growth file is now included in the RPM installer. Fixed an issue where the dispatcher service went into FATAL status and failed to process new jobs after a database outage of a few minutes. Disabled platform gateway authentication in the proxy configuration to allow access to the UI when the control plane is down. With this update, the Receptor data directory can now be configured using the receptor_datadir variable. 9.10. Ansible Automation Platform patch release November 18, 2024 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.10.1. Enhancements With this release, a redirect page has now been implemented that will be exhibited when you navigate to the root / for each component's stand-alone URL. The API endpoint remains functional. This affects Event-Driven Ansible, automation controller, Ansible Automation Platform Operator, and OpenShift Container Platform. 9.10.2. Bug fixes 9.10.2.1. General With this update, the following CVEs have been addressed: CVE-2024-9902 ansible-core: Ansible-core user may read/write unauthorized content. CVE-2024-8775 ansible-core: Exposure of sensitive information in Ansible vault files due to improper logging. 9.10.2.2. Ansible Automation Platform Fixed an issue where the user was unable to filter out hosts on inventory groups where it returned a Failed to load options on Ansible Automation Platform UI.(AAP-34752) 9.10.2.3. Execution Environment Update pywinrm to 0.4.3 in ee-minimal and ee-supported container images to fix Python 3.11 compatibility.(AAP-34077) 9.10.2.4. Ansible Automation Platform Operator Fixed a syntax error when bundle_cacert_secret was defined due to incorrect indentation.(AAP-35358) Fixed an issue where the default operator catalog for Ansible Automation Platform aligned to cluster-scoped versus namespace-scoped.(AAP-35313) Added the ability to set tolerations and node_selector for the Redis statefulset and the gateway deployment.(AAP-33192) Ensure the platform URL status is set when Ingress is used to resolve an issue with Microsoft Azure on Cloud managed deployments. This is due to the Ansible Automation Platform operator failing to finish because it is looking for OpenShift Container Platform routes that are not available on Azure Kubernetes Service.(AAP-34036) Fixed an issue where the Ansible Automation Platform Operator description did not render code block correctly.(AAP-34589) It is necessary to specify the CONTROLLER_SSO_URL and AUTOMATION_HUB_SSO_URL settings in Gateway to fix the OIDC auth redirect flow.(AAP-34080) It is necessary to set the SERVICE_BACKED_SSO_AUTH_CODE_REDIRECT_URL setting to fix the OIDC auth redirect flow.(AAP-34079) 9.10.2.5. Container-based Ansible Automation Platform Fixed an issue when the port value was not defined in the gateway_main_url variable, the containerized installer failed with incorrect execution environment image reference error.(AAP-34716) Fixed an issue where the containerized installer used port number when specifying the image_url for a decision environment. The user should not add a port to image URLs when using the default value.(AAP-34070) 9.10.2.6. RPM-based Ansible Automation Platform Fixed an issue where not setting up the gpg agent socket properly when multiple hub nodes are configured resulted in not creating a gpg socket file in /var/run/pulp .(AAP-34067) 9.10.2.7. Ansible development tools Fixed an issue where missing data files were not included in the molecule RPM package.(AAP-35758) 9.11. Ansible Automation Platform patch release October 28, 2024 The following enhancements and bug fixes have been implemented in this release of Ansible Automation Platform. 9.11.1. Enhancements 9.11.1.1. Ansible Automation Platform With this update, upgrades from Ansible Automation Platform 2.4 to 2.5 are supported for RPM and Operator-based deployments. For more information on how to upgrade, see RPM upgrade and migration . (ANSTRAT-809) Upgrades from 2.4 Containerized Ansible Automation Platform Tech Preview to 2.5 Containerized Ansible Automation Platform are unsupported at this time. Upgrades for Event-Driven Ansible are unsupported from Ansible Automation Platform 2.4 to Ansible Automation Platform 2.5. 9.11.1.2. Ansible Automation Platform Operator An informative redirect page is now shown when you go to the automation hub URL root. (AAP-30915) 9.11.1.3. Container-based Ansible Automation Platform The TLS Certificate Authority private key can now use a passphrase. (AAP-33594) Automation hub is populated with container images (decision and execution environments) and Ansible collections. (AAP-33759) The automation controller, Event-Driven Ansible, and automation hub legacy UIs now display a redirect page to the Platform UI rather than a blank page. (AAP-33794) 9.11.1.4. RPM-based Ansible Automation Platform Added platform Redis to RPM-based Ansible Automation Platform. This allows a 6 node cluster for a Redis high availability (HA) deployment. Removed the variable aap_caching_mtls and replaced it with redis_disable_tls and redis_disable_mtls which are boolean flags that disable Redis server TLS and Redis client certificate authentication. (AAP-33773) An informative redirect page is now shown when going to automation controller, Event-Driven Ansible, or automation hub URL. (AAP-33827) 9.11.2. Bug fixes 9.11.2.1. Ansible Automation Platform Removed the Legacy external password option from the Authentication Type list. (AAP-31506) Ansible Galaxy's sessionauth class is now always the first in the list of authentication classes so that the platform UI can successfully authenticate. (AAP-32146) CVE-2024-10033 - automation-gateway : Fixed a Cross-site Scripting (XSS) vulnerability on the automation-gateway component that allowed a malicious user to perform actions that impact users. CVE-2024-22189 - receptor : Resolved an issue in quic-go that would allow an attacker to trigger a denial of service by sending a large number of NEW_CONNECTION_ID frames that retire old connection IDs. 9.11.2.2. Automation controller CVE-2024-41989 - automation-controller : Before this update, in Django, if floatformat received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption. With this update, decimals with more than 200 digits are now returned as is. CVE-2024-45230 - automation-controller : Resolved an issue in Python's Django urlize() and urlizetrunc() functions where excessive input with a specific sequence of characters would lead to denial of service. 9.11.2.3. Automation hub Refactored the dynaconf hooks to preserve the necessary authentication classes for Ansible Automation Platform 2.5 deployments. (AAP-31680) During role migrations, model permissions are now re-added to roles to preserve ownership. (AAP-31417) 9.11.2.4. Ansible Automation Platform Operator The port is now correctly set when configuring the platform gateway cache redis_host setting when using an external Redis cache. (AAP-33279) Added checksums to the automation hub deployments so that pods are cycled to pick up changes to the PostgreSQL configuration and galaxy server settings Kubernetes secrets. (AAP-33518) 9.11.2.5. Container-based Ansible Automation Platform Fixed the uninstall playbook execution when the environment was already uninstalled. (AAP-32981) 9.12. Ansible Automation Platform patch release October 14, 2024 The following fixes have been implemented in this release of Red Hat Ansible Automation Platform. 9.12.1. Fixed issues 9.12.1.1. Ansible Automation Platform Fixed an issue in platform gateway where examining output logs for UWSGI shows a message that can be viewed as insensitive. (AAP-33213) Fixed external Redis port configuration issue, which resulted in a cluster_host error when trying to connect to Redis. (AAP-32691) Fixed a faulty conditional which was causing managed Redis to be deployed even if an external Redis was being configured. (AAP-31607) After the initial deployment of Ansible Automation Platform, if you make changes to the automation controller, automation hub, or Event-Driven Ansible sections of the Ansible Automation Platform CR specification, those changes are now propagated to the component custom resources. (AAP-32350) Fixed addressing issues when the filter keep_keys is used, all keys are removed from the dictionary. The keepkey fix is available in the updated ansible.utils collection. (AAP-32960) Fixed an issue in cisco.ios.ios_static_routes where the metric distance is to be populated in the forward_router_address attribute. (AAP-32960) Fixed an issue where Ansible Automation Platform Operator is not transferring metric settings to the controller. (AAP-32073) Fixed an issue where you have a schedule on a resource, such as a job template, that prompts for credentials, and you update the credential to be different from what is on the resource by default, the new credential is not submitted to the API and it does not get updated. (AAP-31957) Fixed an issue where setting *pg_host= without any other context no longer results in an empty HOST section of settings.py in controller. (AAP-32440) 9.12.2. Advisories The following errata advisories are included in this release: RHBA-2024:8079 - Product Release Update RHBA-2024:8084 - Container Release Update RHBA-2024:8096 - Cluster Scoped Container Release Update RHBA-2024:8141 - Setup Bundle Release Update 9.13. Ansible Automation Platform patch release October 7, 2024 The following enhancements and fixes have been implemented in this release of Red Hat Ansible Automation Platform. 9.13.1. Enhancements Event-Driven Ansible workers and scheduler add timeout and retry resilience when communicating with a Redis cluster. (AAP-32139) Removed the MTLS credential type that was incorrectly added. (AAP-31848) 9.13.2. Fixed issues 9.13.2.1. Ansible Automation Platform Fixed conditional that was skipping necessary tasks in the restore role, which was causing restores to not finish reconciling. (AAP-30437) Systemd services in the containerized installer are now set with restart policy set to always by default. (AAP-31824) FLUSHDB is now modified to account for shared usage of a Redis database. It now respects access limitations by removing only those keys that the client has permissions to. (AAP-32138) Added a fix to ensure default extra_vars values are rendered in the Prompt on launch wizard. (AAP-30585) Filtered out the unused ANSIBLE_BASE_ settings from the environment variable in job execution. (AAP-32208) 9.13.2.2. Event-Driven Ansible Configured the setting EVENT_STREAM_MTLS_BASE_URL to the correct default to ensure MTLS is disallowed in the RPM installer. (AAP-32027) Configured the setting EVENT_STREAM_MTLS_BASE_URL to the correct default to ensure MTLS is disallowed in the containerized installer. (AAP-31851) Fixed a bug where the Event-Driven Ansible workers and scheduler are unable to reconnect to the Redis cluster if a primary Redis node enters a failed state and a new primary node is promoted. See the KCS article Redis failover causes Event-Driven Ansible activation failures that include the steps that were necessary before this bug was fixed. (AAP-30722) 9.13.3. Advisories The following errata advisories are included in this release: RHBA-2024:7756 - Product Release Update RHBA-2024:7760 - Container Release Update RHBA-2024:7766 - Cluster Scoped Container Release Update RHBA-2024:7810 - Setup Bundle Release Update

Commands: