Red Hat Security Advisory: Red Hat OpenStack Platform 18.0.3 (python-django) security update

Fixed packages 2

Vulnerabilities 4

• High 7.5
  CVE-2024-38875

  Django vulnerable to Denial of Service

  An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• High 7.5
  CVE-2024-39614 Public exploit EPSS 29%

  Django vulnerable to Denial of Service

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• Medium 5.3
  CVE-2024-39329

  Django vulnerable to user enumeration attack

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable pa…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024
• Medium 4.3
  CVE-2024-39330

  Django Path Traversal vulnerability

  An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentia…

  python-django django python-django py3-django Debian Ubuntu Alpine Wolfi PyPI
  Jul 10, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295935
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295936
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295938
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9481.json
• report
  https://access.redhat.com/security/cve/CVE-2024-38875
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-38875
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-38875
• report
  https://access.redhat.com/security/cve/CVE-2024-39329
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-39329
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-39329
• report
  https://access.redhat.com/security/cve/CVE-2024-39330
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-39330
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-39330
• report
  https://access.redhat.com/security/cve/CVE-2024-39614
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-39614
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-39614