Advisories ยป MGASA-2025-0039

Updated python-django packages fix security vulnerabilities

Publication date: 05 Feb 2025
Modification date: 05 Feb 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-56374 , CVE-2024-38875 , CVE-2024-39329 , CVE-2024-39330 , CVE-2024-39614 , CVE-2024-41989 , CVE-2024-41990 , CVE-2024-41991 , CVE-2024-42005 , CVE-2024-45230 , CVE-2024-45231 , CVE-2024-53907 , CVE-2024-53908

Description

An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before
5.0.7. urlize and urlizetrunc were subject to a potential denial of
service attack via certain inputs with a very large number of brackets.
(CVE-2024-38875)
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before
4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate()
method allows remote attackers to enumerate users via a timing attack
involving login requests for users with an unusable password.
(CVE-2024-39329)
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before
4.2.14. Derived classes of the django.core.files.storage.Storage base
class, when they override generate_filename() without replicating the
file-path validations from the parent class, potentially allow directory
traversal via certain inputs during a save() call. (CVE-2024-39330)
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before
4.2.14. get_supported_language_variant() was subject to a potential
denial-of-service attack when used with very long strings containing
specific characters. (CVE-2024-39614)
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before
4.2.15. The floatformat template filter is subject to significant memory
consumption when given a string representation of a number in scientific
notation with a large exponent. (CVE-2024-41989)
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before
4.2.15. The urlize() and urlizetrunc() template filters are subject to a
potential denial-of-service attack via very large inputs with a specific
sequence of characters. (CVE-2024-41990)
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before
4.2.15. The urlize and urlizetrunc template filters, and the
AdminURLFieldWidget widget, are subject to a potential denial-of-service
attack via certain inputs with a very large number of Unicode
characters. (CVE-2024-41991)
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before
4.2.15. QuerySet.values() and values_list() methods on models with a
JSONField are subject to SQL injection in column aliases via a crafted
JSON object key as a passed *arg. (CVE-2024-42005)
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9,
and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters
are subject to a potential denial-of-service attack via very large
inputs with a specific sequence of characters. (CVE-2024-45230)
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The
django.contrib.auth.forms.PasswordResetForm class, when used in a view
implementing password reset flows, allows remote attackers to enumerate
user e-mail addresses by sending password reset requests and observing
the outcome (only when e-mail sending is consistently failing).
(CVE-2024-45231)
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,
and 4.2 before 4.2.17. The strip_tags() method and striptags template
filter are subject to a potential denial-of-service attack via certain
inputs containing large sequences of nested incomplete HTML entities.
(CVE-2024-53907)
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,
and 4.2 before 4.2.17. Direct usage of the
django.db.models.fields.json.HasKey lookup, when an Oracle database is
used, is subject to SQL injection if untrusted data is used as an lhs
value. (CVE-2024-53908)
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11,
and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings
passed when performing IPv6 validation could lead to a potential
denial-of-service attack. The undocumented and private functions
clean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the
django.forms.GenericIPAddressField form field. (CVE-2024-56374)

References

SRPMS

9/core