Red Hat Security Advisory: RHUI 4.3.0 release - Security Fixes, Bug Fixes, and Enhancements Update

Fixed packages 2

Vulnerabilities 2

• High 7.5
  CVE-2022-41323

  Django denial-of-service vulnerability in internationalized URLs

  In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Oct 16, 2022
• High 7.3
  CVE-2021-44420

  Potential bypass of an upstream access control based on URL paths in Django

  In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

  python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  Dec 7, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#low
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2028178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134277
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2136130
• article
  https://issues.redhat.com/browse/RHUI-124
• article
  https://issues.redhat.com/browse/RHUI-149
• article
  https://issues.redhat.com/browse/RHUI-169
• article
  https://issues.redhat.com/browse/RHUI-214
• article
  https://issues.redhat.com/browse/RHUI-296
• article
  https://issues.redhat.com/browse/RHUI-336
• article
  https://issues.redhat.com/browse/RHUI-341
• article
  https://issues.redhat.com/browse/RHUI-355
• article
  https://issues.redhat.com/browse/RHUI-94
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0742.json
• report
  https://access.redhat.com/security/cve/CVE-2021-44420
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-44420
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-44420
• article
  https://www.djangoproject.com/weblog/2021/dec/07/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2022-41323
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41323
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41323
• article
  https://www.djangoproject.com/weblog/2022/oct/04/security-releases/