drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Red Hat OpenStack Platform
Name: |
Mehrere Probleme in Red Hat OpenStack Platform |
|
ID: |
RHSA-2021:3490-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat OpenStack Platform |
|
Datum: |
Mi, 15. September 2021, 23:28 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2021-33571
https://access.redhat.com/security/cve/CVE-2021-33203
https://access.redhat.com/security/cve/CVE-2021-3281 |
|
Applikationen: |
Red Hat OpenStack Platform |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: Red Hat OpenStack Platform 16.2 (python-django20) security update Advisory ID: RHSA-2021:3490-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:3490 Issue date: 2021-09-15 CVE Names: CVE-2021-3281 CVE-2021-33203 CVE-2021-33571 =====================================================================
1. Summary:
An update for python-django20 is now available for Red Hat OpenStack Platform 16.2 (Train).
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 16.2 - noarch
3. Description:
Security Fix(es):
* Potential directory-traversal via archive.extract() (CVE-2021-3281)
* Potential directory traversal via ``admindocs`` (CVE-2021-33203)
* Possible indeterminate SSRF RFI and LFI attacks since validators accepted leading zeros in IPv4 addresses (CVE-2021-33571)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1919969 - CVE-2021-3281 django: Potential directory-traversal via archive.extract() 1937284 - [16.2] python20-django is an old version so we're still affected by rhbz#1919306 1966251 - CVE-2021-33203 django: Potential directory traversal via ``admindocs`` 1966253 - CVE-2021-33571 django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
6. Package List:
Red Hat OpenStack Platform 16.2:
Source: python-django20-2.0.13-16.el8ost.1.src.rpm
noarch: python3-django20-2.0.13-16.el8ost.1.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-3281 https://access.redhat.com/security/cve/CVE-2021-33203 https://access.redhat.com/security/cve/CVE-2021-33571 https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYUGVB9zjgjWX9erEAQhYqQ//WeDnCj1/bpfAgfun2HgblO6Oo3paWU+3 lDL7CZEUmB5koTVnFTePV//M6AArwrlGDlafxarDsT9q5+8317OGADl42nxkFYUY CGE4Wc7xObN/+OUWAn3qN6w/BgNw0PCJupH4UvfRF53wpaP4mmIRNwawWeTZpeFP niPmbhVutQDAjxIo+oKJWOKwNFVHODocf5poxHfsvZI8KDiGMO3KETkWyKUdRZ7j J90RqIxb9MJmJDAaXQ/0rBss7Pd/BjisNYL9Xp4NADfKwIlQEEosLq0VY0lUEjsf 1GzrIkJGVza6zWEeKTiAtMUS/Fo49jy0U2gaQyi0Hokrgcog25NCaytHca3aenlS KC6C9zHF/qFN0R36IZkPv1s6ODtA8BAWNt+OkRMDnsrgyBJI8TGRsoqIRrUIZotW 4KMiS8JVOW663TAhnlY+LgFZI7YwZSwy73vQ+V3Y96NC/14h97lw4NaF2V0w1PkF e0APGU4otO/Rv8WLJ5kAZ51oqgP38fW2nKrqd1zUyIn04VuRWUI84uSen0QW+SCz y9pxEhm2f2q6oJOncdwRzXNtvP2+ao2w3kAebjsSFGHGO8RWd//cM903VHKAPC6B NphLlJJHvpaj8c7KK/zH+dTUMRJPad9Z+v8s//euRENl6epJ4wIwawslAdv9vbJ3 jZiK3XmDUWg= =V+zP -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|