Stay Secure with the Latest Linux Advisories

security advisoryupdateXSS

Mageia 8: MGASA-2022-0104 Moderate: Django XSS And Asgiref DoS

The {% debug %} template tag didn't properly encode the current context posing an XSS attack vector (CVE-2022-22818). Passing certain inputs to multipart forms could result in an infinite loop when parsing files resulting in a denial of service (CVE-2022-23833). . MGASA-2022-0104 - Updated python-django/python-asgiref packages fix security vulnerability Publication date: 21 Mar 2022 URL: https://advisories.mageia.org/MGASA-2022-0104.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-22818, CVE-2022-23833 The {% debug %} template tag didn't properly encode the current context posing an XSS attack vector (CVE-2022-22818). Passing certain inputs to multipart forms could result in an infinite loop when parsing files resulting in a denial of service (CVE-2022-23833). The python-django update necessitated a version update to python-asgiref as well. References: - https://bugs.mageia.org/show_bug.cgi?id=29984 - https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ - https://www.cve.org/CVERecord?id=CVE-2022-22818 - https://www.cve.org/CVERecord?id=CVE-2022-23833 SRPMS: - 8/core/python-django-3.2.12-1.mga8 - 8/core/python-asgiref-3.5.0-1.mga8 . Upgraded django-python/python-asgiref libraries on Mageia mitigate XSS and DoS vulnerabilities successfully.. Python Django Update, Mageia Security Patch, XSS Fix, DoS Issue. . Severity: Important. LinuxSecurity.com Team

Mar 21, 2022 •Important Mageia