Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
awx 24.6.1 targets Django 4.2 (upstream pins django==4.2.10); we ship 4.2.30, the final 4.2 LTS release. This CVE is fixed only in Django 5.2.x, so no Django release exists that awx 24.6.1 supports and that also carries the fix.
Forcing django==5.2.16 into the built venv was tested and fails twice.
First, awx/conf/fields.py:166 reads URLValidator.ul, removed in Django 5.1,
raising AttributeError during app-registry population so every awx-manage
command aborts; that one is patchable in a single line. With it patched,
awx-manage migrate then aborts in _delete_composed_index with "ValueError:
Found wrong number (0) of constraints for
main_adhoccommandevent(ad_hoc_command_id, uuid)" while replaying awx's
historical AlterIndexTogether operations, so a fresh install cannot
complete its migrations. Fixing that requires rewriting awx's migration
history, which is upstream's call, and awx 24.6.1 (2024-07-02) is still the
newest awx tag, so a fix is not expected soon.
Status