USN-7136-2: Django vulnerability
USN-7136-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service. (CVE-2024-53907) Seokchan Yoon discovered that Django incorrectly handled HasKey lookups when using Oracle. A remote attacker could possibly use this issue to inject arbitrary SQL code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-53908)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7136-2?
USN-7136-2 addresses a vulnerability in Django that could potentially allow for remote exploitation.
How do I fix USN-7136-2?
To fix USN-7136-2, you should upgrade to the latest patched version of Django specified in the advisory.
Which versions of Ubuntu are affected by USN-7136-2?
USN-7136-2 affects Ubuntu 16.04 LTS and Ubuntu 18.04 LTS users running specific versions of Django.
Who discovered the issue in USN-7136-2?
The vulnerability addressed in USN-7136-2 was discovered by a security researcher named jiangniao.
What type of vulnerability is addressed in USN-7136-2?
USN-7136-2 addresses a vulnerability related to incorrect handling of the API for stripping tags in Django.