(RHSA-2019:0265) Moderate: Red Hat Gluster Storage Web Administration security update

Red Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into active Gluster storage pools by using the Grafana platform. Red Hat Gluster Storage WebAdministration provides a dashboard view which allows an administrator to get a view of overall gluster health in terms of hosts, volumes, bricks, and other components of GlusterFS.

Security Fix(es):

• django: Catastrophic backtracking in regular expressions via ‘urlize’ and ‘urlizetrunc’ (CVE-2018-7536)

• django: Catastrophic backtracking in regular expressions via ‘truncatechars_html’ and ‘truncatewords_html’ (CVE-2018-7537)

• django: Open redirect possibility in CommonMiddleware (CVE-2018-14574)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Django project for reporting CVE-2018-7536 and CVE-2018-7537.

Users of Red Hat Gluster Storage Web Administration with Red Hat Gluster Storage are advised to upgrade to this updated package to fix these issues.