FlawAtlas
Search the atlas
SUSE-SU-2024:2817-1 Not scored

Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629) - CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630) - CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631) - CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632) - CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398) - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)

Exploit probability Not scored
Published August 7, 2024
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

openSUSE:Leap 15.5 python-Django

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2024:2817-1

This update for python-Django fixes the following issues: - CVE-2024-42005: Fixed SQL injection in QuerySet.values() and values_list() (bsc#1228629) - CVE-2024-41989: Fixed Memory exhaustion in django.utils.numberformat.floatformat() (bsc#1228630) - CVE-2024-41990: Fixed denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228631) - CVE-2024-41991: Fixed another denial-of-service vulnerability in django.utils.html.urlize() (bsc#1228632) - CVE-2022-28346: Fixed SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398) - CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)

View original source

05 / REFERENCES

Further evidence