Red Hat Security AdvisoryRHSA-2023:0742
RHUI 4.3.0 release - Security Fixes, Bug Fixes, and Enhancements Update
Released 2023-02-13 · Red Hat rating Low · View on Red Hat →
Fixed in
- RHUI 4 for RHEL 8 python-django-3.2.16-1.0.1.el8ui, python39-django-3.2.16-1.0.1.el8ui
Fixes 2 records
Priority MEDIUM 45
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03751 · Published 2022-10-16 · Partial fix · 3.2.16, 4.0.8 +1 CWE-1333
Priority LOW 37
In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.02421 · Published 2021-12-07 · Partial fix · 2.2.25, 3.1.14 +1 CWE-287
