# How should we address any new AWX vulnerabilities discovered after version 24.6? **URL:** \ **Category:** Get Help\ **Tags:** awx\ **Created:** [January 23, 2025, 1:49pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782 "2025-01-23T13:49:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![echebao](https://avatars.discourse-cdn.com/v4/letter/e/7bcc69/32.png) [@echebao](https://forum.ansible.com/u/echebao)\ **Post date:** [January 23, 2025, 1:49pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/1 "2025-01-23T13:49:30Z")
How should we address any new AWX vulnerabilities discovered after version 24.6? According to these posts, no new release date has been announced yet for either the AWX operator or AWX. If we are already on the latest AWX version (24.6) and encounter new vulnerabilities, what would be the best approach to address these security issues? > [@Streamlining AWX Releases](https://forum.ansible.com/t/streamlining-awx-releases/6894/4): > > Thanks for those links. In AWX we currently use the PR description to define what type of change this is, the following is from the AWX release process. PR descriptions contain: Bug, Docs Fix or other nominal change or New or Enhanced Feature Getting current versions awx: 24.3.1 awx-operator: 2.16.1 PR https://github.com/ansible/awx/pull/15196 votes z ... PR https://github.com/ansible/awx/pull/15150 votes y PR https://github.com/ansible/awx/pull/15191 votes z https://github.com/ansib… > [@Upcoming changes to AWX Operator installation methods](https://forum.ansible.com/t/upcoming-changes-to-awx-operator-installation-methods/7598): > > Hi everyone, In a couple of recent posts, we’ve talked about [Streamlining AWX Releases](http://forum.ansible.com/t/streamlining-awx-releases/6894/15) as well as Refactoring AWX into a [Pluggable Services-Oriented Architecture](http://forum.ansible.com/t/refactoring-awx-into-a-pluggable-service-oriented-architecture/7404). Now we’d like to announce plans from Red Hat engineering to make changes to how AWX Operator gets released. First, let’s reiterate something that we said in a previous post because the changes I’m going to outline fit into that message: “While we want to make changes that enable more collaboration with our community, at the same tim… ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [January 25, 2025, 1:46pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/2 "2025-01-25T13:46:06Z")
IMO, the basic idea is to rebuild the container image by yourself. In order to address vulnerabilities, of course it is not easy to modify the source code or upgrade the Operator SDK version for everyone. However, if it’s just a simple customization, like wanting to run `dnf update` or to replace existing files, you can create a new image with a simple Dockerfile like the following. For AWX: ```dockerfile FROM quay.io/ansible/awx:24.6.0 USER root RUN dnf update --security --bugfix -y USER 1000 ``` For AWX Operator: ```dockerfile FROM quay.io/ansible/awx-operator:2.19.1 USER root RUN dnf update --security --bugfix -y USER 1001 ``` ---
**Author:** ![echebao](https://avatars.discourse-cdn.com/v4/letter/e/7bcc69/32.png) [@echebao](https://forum.ansible.com/u/echebao)\ **Post date:** [January 27, 2025, 5:42pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/3 "2025-01-27T17:42:28Z")
Thanks for the reply. How do we mitigate vulnerability like the Django version used in AWX? ---
**Author:** ![kurokobo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kurokobo/32/182_2.png) [@kurokobo](https://forum.ansible.com/u/kurokobo)\ **Post date:** [January 27, 2025, 6:02pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/4 "2025-01-27T18:02:51Z")
If upgrading modules is all that is needed, you can address it with a Dockerfile like the following. ```dockerfile FROM quay.io/ansible/awx:24.6.0 USER root RUN dnf update --security --bugfix -y RUN /var/lib/awx/venv/awx/bin/pip install -U django==4.2.18 USER 1000 ``` However, since the version of Django is closely related to [ansible-django-base](https://github.com/ansible/django-ansible-base), which AWX depends on, simply upgrading only the Django module may have side effects or cause AWX to stop working. Please note that I have not tested this Dockerfile at all. I cannot guarantee the results. ---
**Author:** ![echebao](https://avatars.discourse-cdn.com/v4/letter/e/7bcc69/32.png) [@echebao](https://forum.ansible.com/u/echebao)\ **Post date:** [January 28, 2025, 2:10pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/5 "2025-01-28T14:10:36Z")
Thanks for your well explained suggestion. That is just one of the vulnerabilities on our remediation list. This is why I’m asking about the safest approach to address AWX vulnerabilities discovered after version 24.6. ---
**Author:** ![Venkata](https://avatars.discourse-cdn.com/v4/letter/v/f4b2a3/32.png) [@Venkata](https://forum.ansible.com/u/Venkata)\ **Post date:** [June 18, 2026, 3:15pm UTC](https://forum.ansible.com/t/how-should-we-address-any-new-awx-vulnerabilities-discovered-after-version-24-6/39782/6 "2026-06-18T15:15:36Z")
@echebao@kurokobo - I also noticed no new awx versions released. Did rebuilding image helped to remediate vulnerabilities?