python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

A vulnerability was found in Python-Django in the Derived classes of the django.core.files.storage.Storage base class that overrides the generatefilename without replicating the file path validations existing in the parent class. This flaw allows potential directory traversal via certain inputs...

RHEL 7 : python-django (RHSA-2019:0051)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0051 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

RHEL 6 : python-django-horizon and python-django-openstack-auth update (Moderate) (RHSA-2015:0845)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0845 advisory. OpenStack Dashboard horizon provides administrators and users a graphical interface to access, provision and automate cloud-based resources. The...

RHEL 7 : python-django (RHSA-2016:0129)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0129 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

RHEL 7 : python-django (RHSA-2017:1462)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1462 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

RHEL 6 : Django (RHSA-2014:0456)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0456 advisory. The Django web framework is used by horizon, the OpenStack Dashboard, which is a web interface for managing OpenStack services. A flaw was...

RHEL 7 : python-django (RHSA-2016:0505)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0505 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as muc...

python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()

A flaw was found in Python's Django urlize and urlizetrunc functions. Excessive input with a specific sequence of characters may lead to denial of service...

python-django: Memory exhaustion in django.utils.numberformat.floatformat()

A security issue was found in Django. If 'floatformat' received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption. To avoid this, decimals with more than 200 digits are now returned as is...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Internet Bug Bounty: CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()

CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize A vulnerability was reported in the Django web framework's urlize function, which could lead to a denial-of-service attack. The issue was caused by a slow pattern in the urlize function when processing a user input string...

BIT-DJANGO-2024-45230

An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters...

BIT-DJANGO-2024-45231

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...

OESA-2024-2279 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential...

OESA-2024-2278 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential...

OESA-2024-2282 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential...

OESA-2024-2281 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential...

Denial Of Service (DoS)

django is vulnerable to Denial Of Service DoS. The vulnerability is due to the urlize and urlizetrunc template filters being susceptible to very large inputs containing a specific sequence of characters, allows an attacker to execute a denial-of-service attack...

Email Enumeration Attack

Django is vulnerable to Email Enumeration Attack. The vulnerability is due to the PasswordResetForm class revealing differences in responses when password reset emails fail to send, allowing attackers to infer if an email address is registered...