Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 483
Alerts This Week
Warning Icon 1 483

Stay Secure with the Latest Linux Advisories

Mageia Large Esm H800
Mageia

Mageia 10 serd Important Security Bugfix Advisory 2026-0058

Calendar White Jul 20, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 python-pillow Critical Denial of Service CVEs 2026-fc2ded926e

Calendar White Jul 20, 2026
Critical
Fedora Large Esm H900
Fedora

Fedora 43 libseccomp Critical Security Fixes 2026-9afc6b6bb3

Calendar White Jul 20, 2026
Important
Fedora Large Esm H800
Fedora

Fedora 43 dnsx Update Addresses Critical DoS Cross-Site Scripting Issues

Calendar White Jul 20, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 OpenSSH Significant Update for Remote File Misplacement Issue

Calendar White Jul 20, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 freerdp Important Update Notification 2026-fa672d26a8

Calendar White Jul 20, 2026
Important
Fedora Large Esm H800
Fedora

Fedora 43 LibTIFF Critical Security Update for Arbitrary Code Execution

Calendar White Jul 20, 2026
Critical
Fedora Large Esm H900
Fedora

Fedora 43 mingw-python-idna Critical DoS Risk Update 2026-9dbf4d0ca8

Calendar White Jul 20, 2026
Important
Fedora Large Esm H900
Fedora

Fedora 43 mingw-python-pip Critical Path Traversal Risk Advisory

Calendar White Jul 20, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":0,"type":"x","order":4,"pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 23 articles for you...
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisoryDoSimportant

Mageia python-mistune Critical DoS HTML Injection Fix 2026-0254

Security update. Publication date: 15 Jul 2026 URL: https://advisories.mageia.org/MGASA-2026-0254.html Type: security Affected Mageia releases: 10 CVE: CVE-2026-44898, CVE-2026-49851 Description: The updated python-mistune package fixes two security vulnerablities: Prior to 3.2.1, render_toc_ul() builds a table-of-contents tree from a list of (level, id, text) tuples. Both the id value (used as href="# ") and the text value (used as the visible link label) are inserted into tags via a plain Python format string — with no HTML escaping applied to either value. When heading IDs are derived from user-supplied heading text (the standard use-case for readable slug anchors), an attacker can craft a heading whose text breaks out of the href="#..." attribute context, injecting arbitrary HTML tags including blocks directly into the rendered TOC. (CVE-44898) Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining string, resulting in quadratic-time behavior. An attacker-controlled Markdown input can therefore trigger excessive CPU usage with a very small payload. (CVE-2026-49851) References: - https://bugs.mageia.org/show_bug.cgi?id=35773 - https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/W4DK3F2DIMTLJEXWFR5UC6EJVGR7KNR5/ - https://github.com/lepture/mistune/security/advisories/GHSA-qcq2-496w-v96p - https://www.cve.org/CVERecord?id=CVE-2026-44898 - https://www.cve.org/CVERecord?id=CVE-2026-49851 SRPMS: - 10/core/python-mistune-3.3.2-1.mga10 . Mageia security update for python-mistune addresses two critical issues including HTML injection and CPU exhaustion DoS.. python-mistune security update, Mageia advisory, DoS threat, HTML injection risk. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jul 15, 2026 •Important Mageia
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorycriticalweb application

Ubuntu 26.04 LTS libtemplate-perl Critical HTML Injection Vuln 8377-1

Template-Toolkit could allow arbitrary HTML and JavaScript to be injected into generated output.. ========================================================================== Ubuntu Security Notice USN-8377-1 June 03, 2026 libtemplate-perl vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Template-Toolkit could allow arbitrary HTML and JavaScript to be injected into generated output. Software Description: - libtemplate-perl: template processing system in Perl Details: It was discovered that Template-Toolkit did not properly escape single quotes in the html_filter function of Template::Plugin::HTML. An attacker could possibly use this issue to inject arbitrary HTML and JavaScript into generated output. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libtemplate-perl 3.102-1ubuntu0.1 Ubuntu 25.10 libtemplate-perl 2.27-1ubuntu0.25.10.1 Ubuntu 24.04 LTS libtemplate-perl 2.27-1ubuntu0.24.04.1 Ubuntu 22.04 LTS libtemplate-perl 2.27-1ubuntu0.22.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8377-1 CVE-2026-5090 Package Information: https://launchpad.net/ubuntu/+source/libtemplate-perl/3.102-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.25.10.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.24.04.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.22.04.1 . Template-Toolkit in Ubuntu can allow arbitrary HTML and JavaScript injection, potentially compromising system integrity.. Ubuntu libtemplate-perl security fixed issues. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jun 03, 2026 •Critical Ubuntu
Banner 2 1028x280 1708121730 1 1771599631
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisoryUbuntuimportant

Ubuntu 26.04 Template-Toolkit Significant HTML Injection Flaw USN-8377-1

Template-Toolkit could allow arbitrary HTML and JavaScript to be injected into generated output.. ========================================================================== Ubuntu Security Notice USN-8377-1 June 03, 2026 libtemplate-perl vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Template-Toolkit could allow arbitrary HTML and JavaScript to be injected into generated output. Software Description: - libtemplate-perl: template processing system in Perl Details: It was discovered that Template-Toolkit did not properly escape single quotes in the html_filter function of Template::Plugin::HTML. An attacker could possibly use this issue to inject arbitrary HTML and JavaScript into generated output. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libtemplate-perl 3.102-1ubuntu0.1 Ubuntu 25.10 libtemplate-perl 2.27-1ubuntu0.25.10.1 Ubuntu 24.04 LTS libtemplate-perl 2.27-1ubuntu0.24.04.1 Ubuntu 22.04 LTS libtemplate-perl 2.27-1ubuntu0.22.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8377-1 CVE-2026-5090 Package Information: https://launchpad.net/ubuntu/+source/libtemplate-perl/3.102-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.25.10.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.24.04.1 https://launchpad.net/ubuntu/+source/libtemplate-perl/2.27-1ubuntu0.22.04.1 . Template-Toolkit in Ubuntu allows HTML/JavaScript injections. Update recommended to avoid security risks and vulnerabilities.. HTML injection, JavaScript security, Ubuntu Template-Toolkit, system update, libtemplate-perl. . Severity: Important.LinuxSecurity.com Team

Calendar%202 Jun 03, 2026 •Important Ubuntu
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 11: DLA-4322-1 log4cxx Critical HTML JSON Injection CVE-2025-54812

Multiple vulnerabilities were discovered in log4cxx, a logging library for C++ that is compatible with the JAVA log4j framework. CVE-2025-54812 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4322-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Lukas Märdian October 05, 2025 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : log4cxx Version : 0.11.0-2+deb11u1 CVE ID : CVE-2025-54812 CVE-2025-54813 Debian Bug : 1111879 1111881 Multiple vulnerabilities were discovered in log4cxx, a logging library for C++ that is compatible with the JAVA log4j framework. CVE-2025-54812 When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. CVE-2025-54813 When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. For Debian 11 bullseye, these problems have been fixed in version 0.11.0-2+deb11u1. We recommend that you upgrade your log4cxx packages. For the detailed security status of log4cxx please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/log4cxx Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS: Critical log4cxx updateaddresses multiple security issues affecting logging functionalities for C++ applications.. Debian LTS, log4cxx, security update, logging library, critical vulnerabilities. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 04, 2025 •Critical Debian LTS
Banner 2 1028x280 1708121730 1 1771599631
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticaldebian

Debian 11: DLA-4303-1 nextcloud-desktop Critical HTML Injection Advisory

Multiple vulnerabilities were discovered in nextcloud-desktop, nextcloud folder synchronization tool. CVE-2022-39331 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4303-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Abhijith PA September 18, 2025 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : nextcloud-desktop Version : 3.1.1-2+deb11u2 CVE ID : CVE-2022-39331 CVE-2022-39332 CVE-2022-39333 CVE-2022-39334 CVE-2023-28997 Multiple vulnerabilities were discovered in nextcloud-desktop, nextcloud folder synchronization tool. CVE-2022-39331 An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. CVE-2022-39332 An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. CVE-2022-39333 An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. CVE-2022-39334 A CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. CVE-2023-28997 A malicious server administrator can recover and modify the contents of end-to-end encrypted files. For Debian 11 bullseye, these problems have been fixed in version 3.1.1-2+deb11u2. For Debian 11 bullseye, these problems have been fixed in version 3.1.1-2+deb11u2. We recommend that you upgrade your nextcloud-desktop packages. For the detailed security status of nextcloud-desktop please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/nextcloud-desktop Furtherinformation about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The Debian Long Term Support Advisory DLA-4303-1 focuses on serious vulnerabilities found in nextcloud-desktop, particularly emphasizing various HTML injection flaws.. nextcloud-desktop Debian HTML injection TLS security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Sep 18, 2025 •Critical Debian LTS
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorymoderatesoftware update

SUSE: 2024:1864-1 Moderate: Python-Jinja2 HTML Injection Fix

* bsc#1218722 * bsc#1223980 Cross-References: * CVE-2024-22195 . # Security update for python-Jinja2 Announcement ID: SUSE-SU-2024:1864-1 Rating: moderate References: * bsc#1218722 * bsc#1223980 Cross-References: * CVE-2024-22195 * CVE-2024-34064 CVSS scores: * CVE-2024-22195 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2024-22195 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-34064 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * Python 3 Module 15-SP5 * Python 3 Module 15-SP6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves two vulnerabilities can now be installed. ## Description: This update for python-Jinja2 fixes the following issues: * Fixed HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-34064, bsc#1223980, CVE-2024-22195, bsc#1218722) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1864=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1864=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-1864=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-1864=1 * Python 3 Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Python3-15-SP6-2024-1864=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) *python311-Jinja2-3.1.2-150400.12.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python311-Jinja2-3.1.2-150400.12.6.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * python311-Jinja2-3.1.2-150400.12.6.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-Jinja2-3.1.2-150400.12.6.1 * Python 3 Module 15-SP6 (aarch64 ppc64le s390x x86_64) * python311-Jinja2-3.1.2-150400.12.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-22195.html * https://www.suse.com/security/cve/CVE-2024-34064.html * https://bugzilla.suse.com/show_bug.cgi?id=1218722 * https://bugzilla.suse.com/show_bug.cgi?id=1223980 . Stay informed about moderate vulnerabilities in Jinja2 templating engine for Python and ensure your apps use the latest secure version for risk mitigation. SUSE Updates, Python Security, Linux Patch Management. . LinuxSecurity.com Team

Calendar%202 Aug 19, 2024 SuSE
Banner 2 1028x280 1708121730 1 1771599631
100
Ls Advisories Suse Esm H240
Price Tag%201security advisoryimportantxss

SUSE: 2024:2860-1 Important: Python3-Twisted XSS and HTTP Issues

* bsc#1228549 * bsc#1228552 Cross-References: * CVE-2024-41671 . # Security update for python3-Twisted Announcement ID: SUSE-SU-2024:2860-1 Rating: important References: * bsc#1228549 * bsc#1228552 Cross-References: * CVE-2024-41671 * CVE-2024-41810 CVSS scores: * CVE-2024-41671 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-41671 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L * CVE-2024-41810 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N * CVE-2024-41810 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * Server Applications Module 15-SP6 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for python3-Twisted fixes the following issues: * CVE-2024-41671: Fixed HTTP pipelined requests processed out of order in twisted.web (bsc#1228549) * CVE-2024-41810: Fixed reflected XSS via HTML Injection in Redirect Response (bsc#1228552) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methodslike YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-2860=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-2860=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-2860=1 * Server Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP6-2024-2860=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-2860=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-2860=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-2860=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-2860=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-2860=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-2860=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-2860=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python-Twisted-doc-22.2.0-150400.21.1 * python3-Twisted-22.2.0-150400.21.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.21.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.21.1 * Server Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4(aarch64 x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Manager Proxy 4.3 (x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * python3-Twisted-22.2.0-150400.21.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.21.1 ## References: * https://www.suse.com/security/cve/CVE-2024-41671.html * https://www.suse.com/security/cve/CVE-2024-41810.html * https://bugzilla.suse.com/show_bug.cgi?id=1228549 * https://bugzilla.suse.com/show_bug.cgi?id=1228552 . An update for python3-Twisted addresses various vulnerabilities with high severity impacting SUSE offerings.. Security Update, Python3 Twisted, openSUSE Release, Critical Issues. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Aug 09, 2024 •Important SuSE
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorymoderatesoftware update

SUSE: 2024:1863-2 Moderate: python-Jinja2 HTML Injection Issues

* bsc#1218722 * bsc#1223980 Cross-References: * CVE-2024-22195 . # Security update for python-Jinja2 Announcement ID: SUSE-SU-2024:1863-2 Rating: moderate References: * bsc#1218722 * bsc#1223980 Cross-References: * CVE-2024-22195 * CVE-2024-34064 CVSS scores: * CVE-2024-22195 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2024-22195 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-34064 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * SUSE Linux Enterprise Micro 5.5 An update that solves two vulnerabilities can now be installed. ## Description: This update for python-Jinja2 fixes the following issues: * Fixed HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-34064, bsc#1223980, CVE-2024-22195, bsc#1218722) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1863=1 ## Package List: * SUSE Linux Enterprise Micro 5.5 (noarch) * python3-Jinja2-2.10.1-150000.3.13.1 ## References: * https://www.suse.com/security/cve/CVE-2024-22195.html * https://www.suse.com/security/cve/CVE-2024-34064.html * https://bugzilla.suse.com/show_bug.cgi?id=1218722 * https://bugzilla.suse.com/show_bug.cgi?id=1223980 . An update for python-Jinja2 is now available addressing security concerns regarding HTML attribute injection vulnerabilities on SUSE systems.. SUSE Linux, python Jinja2 Update, Security Advisories, Software Patch. . LinuxSecurity.com Team

Calendar%202 Jul 12, 2024 SuSE
Banner 2 1028x280 1708121730 1 1771599631
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":0,"type":"x","order":4,"pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics