Security update for python-Django SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2839-1 Final 1 1 2023-07-14T19:29:37Z current 2023-07-14T19:29:37Z 2023-07-14T19:29:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Django This update for python-Django fixes the following issues: - CVE-2023-31047: Fixed a potential bypass of validation when uploading multiple files using one form field (bsc#1210866). - CVE-2023-36053: Fixed potential regular expression denial of service vulnerability in EmailValidator/URLValidator (bsc#1212742). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2839,openSUSE-SLE-15.5-2023-2839 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232839-1/ Link for SUSE-SU-2023:2839-1 https://lists.suse.com/pipermail/sle-security-updates/2023-July/015497.html E-Mail link for SUSE-SU-2023:2839-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1210866 SUSE Bug 1210866 https://bugzilla.suse.com/1212742 SUSE Bug 1212742 https://www.suse.com/security/cve/CVE-2023-31047/ SUSE CVE CVE-2023-31047 page https://www.suse.com/security/cve/CVE-2023-36053/ SUSE CVE CVE-2023-36053 page openSUSE Leap 15.5 python3-Django-2.0.7-150000.1.11.1 python3-Django-2.0.7-150000.1.11.1 as a component of openSUSE Leap 15.5 In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. CVE-2023-31047 openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232839-1/ https://www.suse.com/security/cve/CVE-2023-31047.html CVE-2023-31047 https://bugzilla.suse.com/1210866 SUSE Bug 1210866 In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. CVE-2023-36053 openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232839-1/ https://www.suse.com/security/cve/CVE-2023-36053.html CVE-2023-36053 https://bugzilla.suse.com/1212742 SUSE Bug 1212742