{ "Definition": [ { "ID": "oval:org.altlinux.errata:def:20192365", "Version": "oval:org.altlinux.errata:def:20192365", "Class": "patch", "Metadata": { "Title": "ALT-PU-2019-2365: package `python3-module-django2.2` update to version 2.2.4-alt1", "AffectedList": [ { "Family": "unix", "Platforms": [ "ALT Linux branch c10f1" ], "Products": [ "ALT SP Workstation", "ALT SP Server" ] } ], "References": [ { "RefID": "ALT-PU-2019-2365", "RefURL": "https://errata.altlinux.org/ALT-PU-2019-2365", "Source": "ALTPU" }, { "RefID": "BDU:2019-03594", "RefURL": "https://bdu.fstec.ru/vul/2019-03594", "Source": "BDU" }, { "RefID": "BDU:2020-01759", "RefURL": "https://bdu.fstec.ru/vul/2020-01759", "Source": "BDU" }, { "RefID": "BDU:2020-01765", "RefURL": "https://bdu.fstec.ru/vul/2020-01765", "Source": "BDU" }, { "RefID": "BDU:2020-01767", "RefURL": "https://bdu.fstec.ru/vul/2020-01767", "Source": "BDU" }, { "RefID": "CVE-2019-14232", "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-14232", "Source": "CVE" }, { "RefID": "CVE-2019-14233", "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-14233", "Source": "CVE" }, { "RefID": "CVE-2019-14234", "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-14234", "Source": "CVE" }, { "RefID": "CVE-2019-14235", "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-14235", "Source": "CVE" } ], "Description": "This update upgrades python3-module-django2.2 to version 2.2.4-alt1. \nSecurity Fix(es):\n\n * BDU:2019-03594: Уязвимость функций django.contrib.postgres.fields.HStoreField и django.contrib.postgres.fields.JSONField фреймворка Django, связанная с отсутствием мер по защите структуры запроса SQL, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании\n\n * BDU:2020-01759: Уязвимость функции jango.utils.encoding.uri_to_iri фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-01765: Уязвимость функции django.utils.text.Truncator методов chars () и words () фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-01767: Уязвимость модуля HTMLParser функции django.utils.html.strip_tags фреймворка для веб-разработки Django, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2019-14232: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.\n\n * CVE-2019-14233: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.\n\n * CVE-2019-14234: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.\n\n * CVE-2019-14235: An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.", "Advisory": { "From": "errata.altlinux.org", "Severity": "Critical", "Rights": "Copyright 2024 BaseALT Ltd.", "Issued": { "Date": "2019-08-05" }, "Updated": { "Date": "2019-08-05" }, "BDUs": [ { "ID": "BDU:2019-03594", "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "CWE": "CWE-89", "Href": "https://bdu.fstec.ru/vul/2019-03594", "Impact": "Critical", "Public": "20190726" }, { "ID": "BDU:2020-01759", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-20", "Href": "https://bdu.fstec.ru/vul/2020-01759", "Impact": "High", "Public": "20190802" }, { "ID": "BDU:2020-01765", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-20", "Href": "https://bdu.fstec.ru/vul/2020-01765", "Impact": "High", "Public": "20190802" }, { "ID": "BDU:2020-01767", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-20", "Href": "https://bdu.fstec.ru/vul/2020-01767", "Impact": "High", "Public": "20190802" } ], "CVEs": [ { "ID": "CVE-2019-14232", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-400", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-14232", "Impact": "High", "Public": "20190802" }, { "ID": "CVE-2019-14233", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-400", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-14233", "Impact": "High", "Public": "20190802" }, { "ID": "CVE-2019-14234", "CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "CWE": "CWE-89", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-14234", "Impact": "Critical", "Public": "20190809" }, { "ID": "CVE-2019-14235", "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "CWE": "CWE-674", "Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-14235", "Impact": "High", "Public": "20190802" } ], "AffectedCPEs": { "CPEs": [ "cpe:/o:alt:spworkstation:10", "cpe:/o:alt:spserver:10" ] } } }, "Criteria": { "Operator": "AND", "Criterions": [ { "TestRef": "oval:org.altlinux.errata:tst:4001", "Comment": "ALT Linux must be installed" } ], "Criterias": [ { "Operator": "OR", "Criterions": [ { "TestRef": "oval:org.altlinux.errata:tst:20192365001", "Comment": "python3-module-django2.2 is earlier than 0:2.2.4-alt1" }, { "TestRef": "oval:org.altlinux.errata:tst:20192365002", "Comment": "python3-module-django2.2-dbbackend-mysql is earlier than 0:2.2.4-alt1" }, { "TestRef": "oval:org.altlinux.errata:tst:20192365003", "Comment": "python3-module-django2.2-dbbackend-psycopg2 is earlier than 0:2.2.4-alt1" }, { "TestRef": "oval:org.altlinux.errata:tst:20192365004", "Comment": "python3-module-django2.2-dbbackend-sqlite3 is earlier than 0:2.2.4-alt1" }, { "TestRef": "oval:org.altlinux.errata:tst:20192365005", "Comment": "python3-module-django2.2-doc is earlier than 0:2.2.4-alt1" }, { "TestRef": "oval:org.altlinux.errata:tst:20192365006", "Comment": "python3-module-django2.2-tests is earlier than 0:2.2.4-alt1" } ] } ] } } ] }