ALT-PU-2019-2365-1
Package python3-module-django2.2 updated to version 2.2.4-alt1 for branch sisyphus in task 235486.
Closed vulnerabilities
BDU:2019-03594
Уязвимость функций django.contrib.postgres.fields.HStoreField и django.contrib.postgres.fields.JSONField фреймворка Django, связанная с отсутствием мер по защите структуры запроса SQL, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
BDU:2020-01759
Уязвимость функции jango.utils.encoding.uri_to_iri фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-01765
Уязвимость функции django.utils.text.Truncator методов chars () и words () фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-01767
Уязвимость модуля HTMLParser функции django.utils.html.strip_tags фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-14232
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1872
- openSUSE-SU-2019:1872
- [oss-security] 20231004 Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator
- [oss-security] 20231004 Django: CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator
- [oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
- [oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- FEDORA-2019-647f74ce51
- FEDORA-2019-647f74ce51
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://security.netapp.com/advisory/ntap-20190828-0002/
- DSA-4498
- DSA-4498
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
Modified: 2024-11-21
CVE-2019-14233
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1872
- openSUSE-SU-2019:1872
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- FEDORA-2019-647f74ce51
- FEDORA-2019-647f74ce51
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://security.netapp.com/advisory/ntap-20190828-0002/
- DSA-4498
- DSA-4498
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
Modified: 2024-11-21
CVE-2019-14234
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
- openSUSE-SU-2019:1872
- openSUSE-SU-2019:1872
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- FEDORA-2019-647f74ce51
- FEDORA-2019-647f74ce51
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://security.netapp.com/advisory/ntap-20190828-0002/
- DSA-4498
- DSA-4498
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
Modified: 2024-11-21
CVE-2019-14235
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1839
- openSUSE-SU-2019:1872
- openSUSE-SU-2019:1872
- https://docs.djangoproject.com/en/dev/releases/security/
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- FEDORA-2019-647f74ce51
- FEDORA-2019-647f74ce51
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- GLSA-202004-17
- GLSA-202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://security.netapp.com/advisory/ntap-20190828-0002/
- DSA-4498
- DSA-4498
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/