RHSA-2023:2097

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (vi…

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded.

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules.

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing.

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization…

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

pgjdbc is an open source postgresql JDBC Driver.