RHSA-2024:3781

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6.

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not app…

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expressi…

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.

Requests is a HTTP library.

Jinja is an extensible templating engine.

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "-…

Python Social Auth is a social authentication/registration mechanism.