Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:4285-1

Опубликовано: 11 дек. 2024
Источник: suse-cvrf

Описание

Security update for python-Django

This update for python-Django fixes the following issues:

  • CVE-2024-53907: Fixed denial-of-service in django.utils.html.strip_tags() (bsc#1234232)
  • CVE-2024-53908: Fixed SQL injection in HasKey(lhs, rhs) on Oracle (bsc#1234231)

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP6
python311-Django-4.2.11-150600.3.12.1
openSUSE Leap 15.6
python311-Django-4.2.11-150600.3.12.1

Ссылки

Описание

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP6:python311-Django-4.2.11-150600.3.12.1
openSUSE Leap 15.6:python311-Django-4.2.11-150600.3.12.1
Ссылки

Описание

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP6:python311-Django-4.2.11-150600.3.12.1
openSUSE Leap 15.6:python311-Django-4.2.11-150600.3.12.1
Ссылки