Lucene search

K
mageiaGentoo FoundationMGASA-2022-0011
HistoryJan 11, 2022 - 10:12 a.m.

Updated python-django packages fix security vulnerability

2022-01-1110:12:42
Gentoo Foundation
advisories.mageia.org
14

0.002 Low

EPSS

Percentile

60.1%

UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack. (CVE-2021-45115) Due to leveraging the Django Template Language’s variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key. (CVE-2021-45116) Storage.save() allowed directory-traversal if directly passed suitably crafted file names. (CVE-2021-45452)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchpython-django< 3.1.14-1.1python-django-3.1.14-1.1.mga8