Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
Security Bulletin
This security bulletin contains information about 14 vulnerabilities.
1) Inefficient regular expression complexity
EUVDB-ID: #VU77880
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-36053
CWE-ID:
CWE-1333 - Inefficient Regular Expression Complexity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within EmailValidator and URLValidator. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Install updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU78448
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-37276
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests in the aiohttp.web.Application. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Resource exhaustion
EUVDB-ID: #VU80395
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-41164
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the django.utils.encoding.uri_to_iri() method. A remote attacker can pass a large number of characters to the affected method and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Resource exhaustion
EUVDB-ID: #VU81657
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-43665
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources within the chars() and words() methods. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU83631
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-47627
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when AIOHTTP_NO_EXTENSIONS is enabled. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU83632
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-49081
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when processing HTTP version. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) NULL pointer dereference
EUVDB-ID: #VU83930
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-49083
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when calling the load_pem_pkcs7_certificates() or load_der_pkcs7_certificates() functions. A remote attacker can pass specially crafted PKCS7 blob/certificate certificate to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Cross-site scripting
EUVDB-ID: #VU85368
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-22195
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the xmlattr filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Path traversal
EUVDB-ID: #VU85886
Risk: High
CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C]
CVE-ID: CVE-2024-23334
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in aiohttp.web.static(follow_symlinks=True). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
Request examples:
For windows: /static/../D:\flag.txt Poc
For Linux: /static/../../../../etc/passwd
Install updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
10) Cryptographic issues
EUVDB-ID: #VU85695
Risk: Medium
CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-23342
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to a side-channel attack on P-256. A remote attacker can launch Minerva attack and gain access to sensitive information.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU85884
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2024-23829
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
12) Resource exhaustion
EUVDB-ID: #VU86190
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-24680
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in intcomma template filter. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Inefficient regular expression complexity
EUVDB-ID: #VU87033
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-27351
CWE-ID:
CWE-1333 - Inefficient Regular Expression Complexity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions in django.utils.text.Truncator.words(). A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Install updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Inconsistent interpretation of HTTP requests
EUVDB-ID: #VU83633
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-49082
CWE-ID:
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when processing HTTP request method. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
MitigationInstall updates from vendor's website.
Red Hat Update Infrastructure (RHUI): before 4.8.0
rhui-tools (Red Hat package): before 4.8.0.1-1.el8ui
rhui-installer (Red Hat package): before 4.8.0.2-1.el8ui
python-zipp (Red Hat package): before 3.4.0-7.el8ui
python-yarl (Red Hat package): before 1.8.2-4.el8ui
python-xlwt (Red Hat package): before 1.3.0-6.el8ui
python-xlrd (Red Hat package): before 2.0.1-8.el8ui
python-wrapt (Red Hat package): before 1.14.1-4.el8ui
python-whitenoise (Red Hat package): before 6.0.0-4.el8ui
python-uuid6 (Red Hat package): before 2023.5.2-4.el8ui
python-urlman (Red Hat package): before 2.0.1-4.el8ui
python-url-normalize (Red Hat package): before 1.4.3-7.el8ui
python-uritemplate (Red Hat package): before 4.1.1-5.el8ui
python-typing-extensions (Red Hat package): before 4.7.1-4.el8ui
python-types-cryptography (Red Hat package): before 3.3.23.2-4.el8ui
python-tablib (Red Hat package): before 3.3.0-4.el8ui
python-sqlparse (Red Hat package): before 0.4.4-3.el8ui
python-redis (Red Hat package): before 4.3.4-4.el8ui
python-pytz (Red Hat package): before 2022.2.1-5.el8ui
python-pyrsistent (Red Hat package): before 0.18.1-5.el8ui
python-pyparsing (Red Hat package): before 3.1.1-3.el8ui
python-pyjwt (Red Hat package): before 2.5.0-4.el8ui
python-pyjwkest (Red Hat package): before 1.4.2-8.el8ui
python-pygtrie (Red Hat package): before 2.5.0-4.el8ui
python-pycryptodomex (Red Hat package): before 3.14.1-5.el8ui
python-pycares (Red Hat package): before 4.1.2-5.el8ui
python-pulpcore-client (Red Hat package): before 3.39.7-1.0.1.el8ui
python-pulpcore (Red Hat package): before 3.39.11-1.el8ui
python-pulp-rpm-client (Red Hat package): before 3.23.0-2.0.1.el8ui
python-pulp-rpm (Red Hat package): before 3.23.0-2.el8ui
python-pulp-glue (Red Hat package): before 0.21.2-3.el8ui
python-pulp-container-client (Red Hat package): before 2.16.4-1.0.1.el8ui
python-pulp-container (Red Hat package): before 2.16.4-1.el8ui
python-psycopg (Red Hat package): before 3.1.9-4.el8ui
python-protobuf (Red Hat package): before 4.21.6-4.el8ui
python-productmd (Red Hat package): before 1.33-6.el8ui
python-packaging (Red Hat package): before 21.3-5.el8ui
python-opentelemetry_sdk (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_proto (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_exporter_otlp_proto_http (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_grpc (Red Hat package): before 1.19.0-5.el8ui
python-opentelemetry_exporter_otlp_proto_common (Red Hat package): before 1.19.0-3.el8ui
python-opentelemetry_exporter_otlp (Red Hat package): before 1.19.0-4.el8ui
python-opentelemetry_api (Red Hat package): before 1.19.0-3.el8ui
python-openpyxl (Red Hat package): before 3.1.0-4.el8ui
python-odfpy (Red Hat package): before 1.4.1-9.el8ui
python-multidict (Red Hat package): before 6.0.4-4.el8ui
python-markupsafe (Red Hat package): before 2.1.2-4.el8ui
python-markuppy (Red Hat package): before 1.14-6.el8ui
python-jsonschema (Red Hat package): before 4.10.3-3.el8ui
python-json-stream-rs-tokenizer (Red Hat package): before 0.4.25-3.el8ui
python-json-stream (Red Hat package): before 2.3.2-4.el8ui
python-jq (Red Hat package): before 1.6.0-3.el8ui
python-jinja2 (Red Hat package): before 3.1.3-1.el8ui
python-inflection (Red Hat package): before 0.5.1-6.el8ui
python-importlib-metadata (Red Hat package): before 6.0.1-4.el8ui
python-gunicorn (Red Hat package): before 20.1.0-7.1.2.el8ui
python-grpcio (Red Hat package): before 1.56.0-4.el8ui
python-googleapis-common-protos (Red Hat package): before 1.59.1-4.el8ui
python-gnupg (Red Hat package): before 0.5.0-4.el8ui
python-future (Red Hat package): before 0.18.3-4.el8ui
python-frozenlist (Red Hat package): before 1.3.3-4.el8ui
python-et-xmlfile (Red Hat package): before 1.1.0-5.el8ui
python-ecdsa (Red Hat package): before 0.18.0-4.el8ui
python-dynaconf (Red Hat package): before 3.1.12-3.el8ui
python-drf-spectacular (Red Hat package): before 0.26.5-4.el8ui
python-drf-nested-routers (Red Hat package): before 0.93.4-5.el8ui
python-drf-access-policy (Red Hat package): before 1.3.0-3.el8ui
python-djangorestframework-queryfields (Red Hat package): before 1.0.0-7.el8ui
python-djangorestframework (Red Hat package): before 3.14.0-3.el8ui
python-django-readonly-field (Red Hat package): before 1.1.2-3.el8ui
python-django-lifecycle (Red Hat package): before 1.0.0-3.el8ui
python-django-import-export (Red Hat package): before 3.1.0-3.el8ui
python-django-guid (Red Hat package): before 3.3.0-4.el8ui
python-django-filter (Red Hat package): before 23.2-3.el8ui
python-django (Red Hat package): before 4.2.11-1.el8ui
python-diff-match-patch (Red Hat package): before 20200713-6.el8ui
python-deprecated (Red Hat package): before 1.2.13-4.el8ui
python-defusedxml (Red Hat package): before 0.7.1-6.el8ui
python-cryptography (Red Hat package): before 41.0.6-1.el8ui
python-click (Red Hat package): before 8.1.3-4.el8ui
python-brotli (Red Hat package): before 1.0.9-5.el8ui
python-backoff (Red Hat package): before 2.2.1-4.el8ui
python-attrs (Red Hat package): before 21.4.0-5.el8ui
python-asyncio-throttle (Red Hat package): before 1.0.2-6.el8ui
python-async-timeout (Red Hat package): before 4.0.2-5.el8ui
python-asgiref (Red Hat package): before 3.6.0-4.el8ui
python-aiosignal (Red Hat package): before 1.3.1-4.el8ui
python-aioredis (Red Hat package): before 2.0.1-5.el8ui
python-aiohttp-xmlrpc (Red Hat package): before 1.5.0-5.el8ui
python-aiohttp (Red Hat package): before 3.9.2-1.el8ui
python-aiofiles (Red Hat package): before 22.1.0-4.el8ui
python-aiodns (Red Hat package): before 3.0.0-6.el8ui
pulpcore-selinux (Red Hat package): before 2.0.1-1.el8ui
libsolv (Red Hat package): before 0.7.22-6.el8ui
libcomps (Red Hat package): before 0.1.18-8.el8ui
createrepo_c (Red Hat package): before 1.0.2-5.el8ui
ansible-collection-community-crypto (Red Hat package): before 2.18.0-1.el8ui
External linkshttp://access.redhat.com/errata/RHSA-2024:1878
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
