Red Hat Security AdvisoryRHSA-2025:1335
RHUI 4.11 security, bugfix, and enhancement update
Released 2025-02-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHUI 4 for RHEL 8 python-aiohttp-3.9.4-1.el8ui, python-cryptography-42.0.8-1.el8ui, python-django-4.2.15-1.el8ui +13
Fixes 13 records
Priority HIGH 72
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03237 · Published 2024-04-30 · Partial fix · 0.5.0 CWE-674
Priority MEDIUM 62
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.28637 · Published 2024-07-10 · Partial fix · 5.0.7, 4.2.14 CWE-130
Priority MEDIUM 52
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01503 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-89
Priority MEDIUM 46
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02996 · Published 2024-04-16 · Partial fix · 22.0.0 CWE-444
Priority MEDIUM 41
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00954 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-130
Priority MEDIUM 41
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01258 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-130
Priority MEDIUM 41
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.012 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-400
Priority MEDIUM 41
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01094 · Published 2024-05-02 · Partial fix · 3.9.4 CWE-835
Priority MEDIUM 40
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00831 · Published 2024-02-21 · Fixed in 42.0.4 CWE-476
Priority LOW 28
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00666 · Published 2024-04-18 · Partial fix · 3.9.4 CWE-79
Priority LOW 27
Requests is a HTTP library.
CVSS 3.1MEDIUM 5.6· Local · High privileges · User interaction · EPSS 0.0034 · Published 2024-05-20 · Partial fix · 2.32.0 CWE-670
Priority LOW 27
It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00222 · Published 2024-08-06 · Partial fix CWE-440
Priority LOW 26
Jinja is an extensible templating engine.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00979 · Published 2024-05-06 · Partial fix · 3.1.4 CWE-79
THREATIST.IORead the docs