An update for python-django is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2004 Final 1.0 1.0 2024-08-16 Initial 2024-08-16 2024-08-16 openEuler SA Tool V1.0 2024-08-16 python-django security update An update for python-django is now available for openEuler-22.03-LTS-SP1 Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fix(es): An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.(CVE-2024-38875) An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.(CVE-2024-39329) An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)(CVE-2024-39330) An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters.(CVE-2024-39614) An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.(CVE-2024-41989) An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.(CVE-2024-41990) An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.(CVE-2024-41991) An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.(CVE-2024-42005) An update for python-django is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical python-django https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-38875 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-39329 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-39330 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-39614 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-41989 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-41990 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-41991 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-42005 https://nvd.nist.gov/vuln/detail/CVE-2024-38875 https://nvd.nist.gov/vuln/detail/CVE-2024-39329 https://nvd.nist.gov/vuln/detail/CVE-2024-39330 https://nvd.nist.gov/vuln/detail/CVE-2024-39614 https://nvd.nist.gov/vuln/detail/CVE-2024-41989 https://nvd.nist.gov/vuln/detail/CVE-2024-41990 https://nvd.nist.gov/vuln/detail/CVE-2024-41991 https://nvd.nist.gov/vuln/detail/CVE-2024-42005 openEuler-22.03-LTS-SP1 python-django-4.2.15-1.oe2203sp1.src.rpm python-django-help-4.2.15-1.oe2203sp1.noarch.rpm python3-Django-4.2.15-1.oe2203sp1.noarch.rpm An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. 2024-08-16 CVE-2024-38875 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. 2024-08-16 CVE-2024-39329 openEuler-22.03-LTS-SP1 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.) 2024-08-16 CVE-2024-39330 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. 2024-08-16 CVE-2024-39614 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. 2024-08-16 CVE-2024-41989 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. 2024-08-16 CVE-2024-41990 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. 2024-08-16 CVE-2024-41991 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004 An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. 2024-08-16 CVE-2024-42005 openEuler-22.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H python-django security update 2024-08-16 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2004