Alerts This Week
Warning Icon 1 975
Alerts This Week
Warning Icon 1 975

openSUSE Leap 15.5: 2024:2817-1 Important Python-Django DoS & SQL Issues

suse
Calendar Grey August 7, 2024
Dist Suse Esm H88
Urgent security patch for python-Django on openSUSE Leap tackling various threats and vulnerabilities.
* bsc#1136468 * bsc#1198398 * bsc#1228629 * bsc#1228630 * bsc#1228631

Summary

## This update for python-Django fixes the following issues: * CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629) * CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630) * CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631) * CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632) * CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398) * CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

Topics%20covered

Topics Covered

security advisory security update DoS important SQL injection openSUSE python-Django

References

* bsc#1136468

* bsc#1198398

* bsc#1228629

* bsc#1228630

* bsc#1228631

* bsc#1228632

Cross-

* CVE-2019-12308

* CVE-2022-28346

* CVE-2024-41989

* CVE-2024-41990

* CVE-2024-41991

* CVE-2024-42005

CVSS scores:

* CVE-2019-12308 ( SUSE ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

* CVE-2019-12308 ( NVD ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

* CVE-2022-28346 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

* CVE-2022-28346 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2024-41989 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-41990 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-41991 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:2817-1
Rating: important

Topics%20covered

Topics Covered

security advisory security update DoS important SQL injection openSUSE python-Django

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here