Summary
[1.0.2-1.el8]
- Fix multiple CVEs : CVE-2017-18342, CVE-2020-10109, CVE-2020-10108,
CVE-2021-33203, CVE-2021-33571, CVE-2021-44420, CVE-2021-31542,
CVE-2021-28658, CVE-2021-28957, CVE-2021-43818, CVE-2020-27783 [Orabug:
34109801]
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | ol-automation-manager | 0:1.0.2-1.el8 |
| Oracle Linux · 8 | ol-automation-manager-cli | 0:1.0.2-1.el8 |
| Oracle Linux · 8 | python3-olamkit | 0:1.0.2-1.el8 |
Vulnerabilities 11
-
Critical 9.8
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.
-
Critical 9.8
Improper Input Validation in Twisted
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelin…
-
Critical 9.8
HTTP Request Smuggling in Twisted
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined requ…
-
High 8.2
HTML Cleaner allows crafted and SVG embedded scripts to pass through
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…
-
High 7.5
Path Traversal in Django
In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
-
High 7.5
Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addr…
-
High 7.3
Potential bypass of an upstream access control based on URL paths in Django
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
-
Medium 6.1
lxml vulnerable to Cross-site Scripting
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML…
-
Medium 6.1
lxml vulnerable to Cross-Site Scripting
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…
-
Medium 5.3
Directory Traversal in Django
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
-
Medium 4.9
Path Traversal in Django
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the…