SB2019080602 - Arch Linux update for python2-django
Published: August 6, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource management error (CVE-ID: CVE-2019-14232)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to usage of truncatechars_html and truncatewords_html template filters in django.utils.text.Truncator during evaluation of HTML content. A remote attacker can pass large content in HTML format to the application and trigger resource exhaustion.
2) Resource management error (CVE-ID: CVE-2019-14233)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to usage of django.utils.html.strip_tags() during evaluation of HTML content. A remote attacker can pass large content in HTML format to the application and trigger resource exhaustion.
3) SQL injection (CVE-ID: CVE-2019-14234)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in django.contrib.postgres.fields.JSONField and django.contrib.postgres.fields.HStoreField. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
4) Resource management error (CVE-ID: CVE-2019-14235)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error when parsing URF-8 data with django.utils.encoding.uri_to_iri(). A remote attacker can pass specially crafted content to the application and consume all available memory on the system.
Remediation
Install update from vendor's website.