Skip to content
OpenAdvisories
High RHSA-2024:1878 14 CVEs

Red Hat Security Advisory: RHUI 4.8 Release - Security Updates, Bug Fixes, and Enhancements

Published Sep 28, 2024 · Updated Sep 9, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · Rhui 4 rhui:4::el8 python-aiohttp 0:3.9.2-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-aiohttp-debugsource 0:3.9.2-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-cryptography 0:41.0.6-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-cryptography-debugsource 0:41.0.6-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-django 0:4.2.11-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-ecdsa 0:0.18.0-4.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-jinja2 0:3.1.3-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-aiohttp 0:3.9.2-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-aiohttp-debuginfo 0:3.9.2-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-cryptography 0:41.0.6-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-cryptography-debuginfo 0:41.0.6-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-django 0:4.2.11-1.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-ecdsa 0:0.18.0-4.el8ui
Red Hat · Rhui 4 rhui:4::el8 python3.11-jinja2 0:3.1.3-1.el8ui

Vulnerabilities 14

  • High 7.5
    CVE-2023-36053

    Django has regular expression denial of service vulnerability in EmailValidator/URLValidator

    In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2024-24680

    Django denial-of-service attack in the intcomma template filter

    An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

    python-django django python-django py3-django Debian Ubuntu Wolfi PyPI
  • High 7.4
    CVE-2024-23342

    python-ecdsa vulnerable to Minerva attack on P-256

    The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Vers…

    tlsfuzzer python-ecdsa open-webui airflow-3 Debian Ubuntu Wolfi PyPI
  • High 7.2
    CVE-2023-49081

    aiohttp's ClientSession is vulnerable to CRLF injection via version

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP versio…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Wolfi PyPI
  • Medium 6.5
    CVE-2024-23829

    aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of p…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.9
    CVE-2023-43665

    Django Denial-of-service in django.utils.text.Truncator

    In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potential…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.9
    CVE-2023-49083

    cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerab…

    pyca cryptography py3-cassandra-medusa mitmproxy Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 5.9
    CVE-2024-23334 Public exploit Scanner template EPSS 77%

    aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.4
    CVE-2024-22195

    Jinja vulnerable to Cross-Site Scripting (XSS)

    Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …

    pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.3
    CVE-2023-37276

    aiohttp vulnerable to HTTP request smuggling

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing …

    aio-libs aiohttp python-aiohttp aiohttp Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2023-41164

    Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

    In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Medium 5.3
    CVE-2023-47627

    Request smuggling in aiohttp

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 5.3
    CVE-2023-49082

    aiohttp's ClientSession is vulnerable to CRLF injection via method

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP met…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Wolfi PyPI
  • Medium 5.3
    CVE-2024-27351

    Regular expression denial-of-service in Django

    In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a craft…

    python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2218004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2224185
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2227307
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2237258
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2241046
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2249825
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252235
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2252248
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2255331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2257854
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2259780
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2261856
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2261887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2261909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2266045
  • article
    https://issues.redhat.com/browse/RHUI-434
  • article
    https://issues.redhat.com/browse/RHUI-514
  • article
    https://issues.redhat.com/browse/RHUI-516
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1878.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-36053
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-36053
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-36053
  • article
    https://www.djangoproject.com/weblog/2023/jul/03/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2023-37276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-37276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-37276
  • article
    https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w
  • report
    https://access.redhat.com/security/cve/CVE-2023-41164
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-41164
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-41164
  • article
    https://www.djangoproject.com/weblog/2023/sep/04/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2023-43665
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-43665
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-43665
  • article
    https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2023-47627
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-47627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-47627