CVE-2024-39329

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password...

SUSE-SU-2024:1141-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2024-27351: Align the patch with the upstream one and make it more robust. bsc1220358...

MGASA-2024-0075 Updated python-django package fixes a security vulnerability

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. CVE-2024-27351...

OPENSUSE-SU-2024:0080-1 Security update for python-Django1

This update for python-Django1 fixes the following issues: - CVE-2024-27351: Fixed a denial-of-service in regular expression of django.utils.text.Truncator.words boo1220358...

OPENSUSE-SU-2024:0077-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2024-27351: Fixed a denial-of-service in regular expression of django.utils.text.Truncator.words boo1220358...

OESA-2024-1254 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewordshtml filter of Django. This issue may allow an attacker to use a...

BIT-DJANGO-2023-36053

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS regular expression denial of service attack via a very large number of domain name labels of emails and URLs...

CVE-2024-24680

An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings...

CVE-2023-36053

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS regular expression denial of service attack via a very large number of domain name labels of emails and URLs...

Debian: Security Advisory (DLA-3415-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3415 : python-django - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3415 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3415-1 [email protected] https://www.debian.org/lts/security/...

OPENSUSE-SU-2023:0077-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-24580: Prevent DOS in file uploads. boo1208082 update to 1.11.15 CVE-2018-14574: Fixed Open redirect possibility in CommonMiddleware boo1102680 Fixed WKBWriter.write and writehex for empty polygons on GEOS 3.6.1+ Fixed a...

SUSE-SU-2023:0704-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-24580: Fixed DOS in file uploads bsc1208082...

OPENSUSE-SU-2023:0005-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs boo1203793 - CVE-2022-36359: Fixed a potential reflected file download vulnerability in FileResponse boo1201923 - Update from 2.2.12 to 2.2.28...

Security update for python-Django (important)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2023:0005-1 Rating: important References: 1185713 1186608 1186611 1193240 1194115 1194116 1194117 1195086 1195088 1198297 1198398 1198399 1201923 1203793 Cross-References: CVE-2021-32052 CVE-2021-33203...

DLA-3164-1 python-django - security update

Bulletin has no description...

Django denial-of-service vulnerability in internationalized URLs

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression...

MGASA-2022-0281 Updated python-django packages fix security vulnerability

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...

DLA-2982-1 python-django - security update

Bulletin has no description...

SUSE-SU-2022:0286-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2022-22818: Fixed possible XSS via % debug % template tag bsc1195086 - CVE-2022-23833: Fixed denial-of-service possibility in file uploads. bsc1195088 A regression in the fix for CVE-2021-45452 was fixed bsc1194116...