ALT-BU-2020-3758-1
Branch sisyphus update bulletin.
Package python3-module-django2.2 updated to version 2.2.12-alt1 for branch sisyphus in task 249815.
Closed vulnerabilities
BDU:2020-01459
Уязвимость фреймворка для веб-приложений Django, связанная с ошибкой в работе механизма восстановления паролей, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2020-05726
Уязвимость библиотеки Django для языка программирования Python, позволяющая нарушителю выполнить произвольный код
BDU:2021-03743
Уязвимость компонента contrib.postgres.aggregates.StringAgg программной платформы для веб-приложений Django, связанная с непринятием мер по защите структуры SQL-запроса, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-19118
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
- [oss-security] 20191202 Django 2.2.8 and 2.1.15: CVE-2019-19118: Privilege escalation in the Django admin.
- [oss-security] 20191202 Django 2.2.8 and 2.1.15: CVE-2019-19118: Privilege escalation in the Django admin.
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ
- https://groups.google.com/forum/#%21topic/django-announce/GjGqDvtNmWQ
- FEDORA-2019-adc8990386
- FEDORA-2019-adc8990386
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20191217-0003/
- https://security.netapp.com/advisory/ntap-20191217-0003/
- https://www.djangoproject.com/weblog/2019/dec/02/security-releases/
- https://www.djangoproject.com/weblog/2019/dec/02/security-releases/
Modified: 2024-11-21
CVE-2019-19844
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
- http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html
- http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0
- https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0
- FEDORA-2020-adb4f0143a
- FEDORA-2020-adb4f0143a
- 20200108 [SECURITY] [DSA 4598-1] python-django security update
- 20200108 [SECURITY] [DSA 4598-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20200110-0003/
- https://security.netapp.com/advisory/ntap-20200110-0003/
- USN-4224-1
- USN-4224-1
- DSA-4598
- DSA-4598
- https://www.djangoproject.com/weblog/2019/dec/18/security-releases/
- https://www.djangoproject.com/weblog/2019/dec/18/security-releases/
Modified: 2024-11-21
CVE-2020-7471
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
- [oss-security] 20200203 Django 3.0.3, 2.2.10 and 1.11.28: CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
- [oss-security] 20200203 Django 3.0.3, 2.2.10 and 1.11.28: CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
- https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
- https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI
- https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI
- FEDORA-2020-c2639662af
- FEDORA-2020-c2639662af
- 20200219 [SECURITY] [DSA 4629-1] python-django security update
- 20200219 [SECURITY] [DSA 4629-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20200221-0006/
- https://security.netapp.com/advisory/ntap-20200221-0006/
- USN-4264-1
- USN-4264-1
- DSA-4629
- DSA-4629
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://www.openwall.com/lists/oss-security/2020/02/03/1
- https://www.openwall.com/lists/oss-security/2020/02/03/1
Modified: 2024-11-21
CVE-2020-9402
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/fLUh_pOaKrY
- https://groups.google.com/forum/#%21topic/django-announce/fLUh_pOaKrY
- [debian-lts-announce] 20220526 [SECURITY] [DLA 3024-1] python-django security update
- [debian-lts-announce] 20220526 [SECURITY] [DLA 3024-1] python-django security update
- FEDORA-2020-c2639662af
- FEDORA-2020-c2639662af
- FEDORA-2020-2e7d30f7aa
- FEDORA-2020-2e7d30f7aa
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20200327-0004/
- https://security.netapp.com/advisory/ntap-20200327-0004/
- USN-4296-1
- USN-4296-1
- DSA-4705
- DSA-4705
- https://www.djangoproject.com/weblog/2020/mar/04/security-releases/
- https://www.djangoproject.com/weblog/2020/mar/04/security-releases/
Package python-module-psutil updated to version 5.7.0-alt1 for branch sisyphus in task 249818.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2019-18874
psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
- https://github.com/giampaolo/psutil/pull/1616
- https://github.com/giampaolo/psutil/pull/1616
- [debian-lts-announce] 20191118 [SECURITY] [DLA 1998-1] python-psutil security update
- [debian-lts-announce] 20191118 [SECURITY] [DLA 1998-1] python-psutil security update
- FEDORA-2020-a06ebafad8
- FEDORA-2020-a06ebafad8
- FEDORA-2020-021fb887ac
- FEDORA-2020-021fb887ac
- USN-4204-1
- USN-4204-1
Closed bugs
Обновить компонент. CVE-2019-18874