Skip to content
OpenAdvisories
Critical RHSA-2020:1324 5 CVEs

Red Hat Security Advisory: python-django security update

Published Sep 18, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 15 openstack:15::el8 python-django 0:2.1.11-1.el8ost
Red Hat · OpenStack 15 openstack:15::el8 python-django-bash-completion 0:2.1.11-1.el8ost
Red Hat · OpenStack 15 openstack:15::el8 python3-django 0:2.1.11-1.el8ost

Vulnerabilities 5

  • Critical 9.8
    CVE-2019-14234 Public exploit EPSS 48%

    SQL Injection in Django

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-14232

    Django Denial-of-service in django.utils.text.Truncator

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-14233

    Django Denial-of-service in strip_tags()

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2019-14235

    Uncontrolled Recursion in Django

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 oc…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2019-12781

    Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

    An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. …

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1724497
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1734405
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1734410
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1734417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1734422
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1324.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-12781
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-12781
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-12781
  • article
    https://www.djangoproject.com/weblog/2019/jul/01/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2019-14232
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14232
  • article
    https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2019-14233
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14233
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14233
  • report
    https://access.redhat.com/security/cve/CVE-2019-14234
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14234
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14234
  • report
    https://access.redhat.com/security/cve/CVE-2019-14235
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-14235
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-14235