Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2545-1

Опубликовано: 17 июл. 2024
Источник: suse-cvrf

Описание

Security update for python-Django

This update for python-Django fixes the following issues:

  • CVE-2024-38875: Fixed potential denial-of-service attack via certain inputs with a very large number of brackets (bsc#1227590)
  • CVE-2024-39329: Fixed username enumeration through timing difference for users with unusable passwords (bsc#1227593)
  • CVE-2024-39330: Fixed potential directory traversal in django.core.files.storage.Storage.save() (bsc#1227594)
  • CVE-2024-39614: Fixed potential denial-of-service through django.utils.translation.get_supported_language_variant() (bsc#1227595)
  • CVE-2023-23969: Fixed potential denial-of-service via Accept-Language headers (bsc#1207565)

Список пакетов

openSUSE Leap 15.5
python3-Django-2.0.7-150000.1.20.1

Ссылки

Описание

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

Затронутые продукты
openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1
Ссылки

Описание

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

Затронутые продукты
openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1
Ссылки

Описание

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

Затронутые продукты
openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1
Ссылки

Описание

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

Затронутые продукты
openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1
Ссылки

Описание

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

Затронутые продукты
openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1
Ссылки