Red Hat OpenStack Platform 18.0.3 includes a security update for the python-django package that fixes four vulnerabilities: CVE-2024-38875 and CVE-2024-39614 are potential denial-of-service issues in specific Django utility functions; CVE-2024-39329 allows username enumeration through timing differences for accounts with unusable passwords; CVE-2024-39330 is a potential directory traversal vulnerability in the file storage save method. These issues affect the Django framework version 3.2.12-8.el9ost.src used in this platform. The update is rated moderate in severity and addresses these vulnerabilities to improve security posture.

The vulnerabilities could allow an attacker to cause denial-of-service conditions via specific Django functions, enumerate usernames by measuring timing differences for accounts with unusable passwords, and potentially perform directory traversal attacks when saving files. These impacts could lead to service disruption and information disclosure about valid usernames. No known exploits in the wild have been reported. The overall security impact is considered moderate.

A security update for python-django is available for Red Hat OpenStack Platform 18.0.3 that addresses these vulnerabilities. Users should apply this update following Red Hat's official guidance for new deployments or updating existing environments. Prior to applying this update, ensure all previously released errata relevant to the system have been applied. No additional mitigation actions are indicated by the vendor advisory.