Skip to content
OpenAdvisories
High RHSA-2023:2101 3 CVEs

Red Hat Security Advisory: RHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update

Published Sep 18, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · Rhui 4 rhui:4::el8 python-django 0:3.2.18-1.0.1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-future 0:0.18.3-1.0.1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python39-django 0:3.2.18-1.0.1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python39-future 0:0.18.3-1.0.1.el8ui

Vulnerabilities 3

  • High 7.5
    CVE-2022-40899

    Python Charmers Future denial of service vulnerability

    An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.

    future python-future python-future Debian Ubuntu PyPI
  • High 7.5
    CVE-2023-23969 EPSS 47%

    Django contains Uncontrolled Resource Consumption via cached header

    In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value o…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2023-24580 EPSS 63%

    Resource exhaustion in Django

    An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhausti…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2036408
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2084950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2165444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2165866
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2166457
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2169402
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2174316
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2174633
  • article
    https://issues.redhat.com/browse/RHUI-134
  • article
    https://issues.redhat.com/browse/RHUI-148
  • article
    https://issues.redhat.com/browse/RHUI-199
  • article
    https://issues.redhat.com/browse/RHUI-230
  • article
    https://issues.redhat.com/browse/RHUI-342
  • article
    https://issues.redhat.com/browse/RHUI-354
  • article
    https://issues.redhat.com/browse/RHUI-362
  • article
    https://issues.redhat.com/browse/RHUI-368
  • article
    https://issues.redhat.com/browse/RHUI-370
  • article
    https://issues.redhat.com/browse/RHUI-371
  • article
    https://issues.redhat.com/browse/RHUI-372
  • article
    https://issues.redhat.com/browse/RHUI-376
  • article
    https://issues.redhat.com/browse/RHUI-377
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2101.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-40899
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-40899
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-40899
  • report
    https://access.redhat.com/security/cve/CVE-2023-23969
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-23969
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-23969
  • article
    https://github.com/django/django/commit/4452642f193533e288a52c02efb5bbc766a68f95
  • article
    https://github.com/django/django/commit/8a7b22d4a623bcd95190d2f5a958472fb41e576d
  • article
    https://github.com/django/django/commit/8c660fb59239828583f17cdede3b64f208b8752c
  • article
    https://github.com/django/django/commit/9d7bd5a56b1ce0576e8e07a8001373576d277942
  • article
    https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a
  • article
    https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2023-24580
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-24580
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-24580
  • article
    https://www.djangoproject.com/weblog/2023/feb/14/security-releases/