Security update for python-Django

2024-08-3013:49:59

Google

osv.dev

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

This update for python-Django fixes the following issues:

CVE-2024-42005: Fixed potential SQL injection in QuerySet.values() and values_list() (boo#1228629)
CVE-2024-41989: Fixed memory exhaustion in django.utils.numberformat.floatformat() (boo#1228630)
CVE-2024-41990: Fixed potential denial-of-service vulnerability in django.utils.html.urlize() (boo#1228631)
CVE-2024-41991: Fixed potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget (boo#1228632)