Threat database

A security update for python3 in Red Hat Enterprise Linux addresses a SQL injection vulnerability in the python-pymysql package when used with untrusted JSON input (CVE-2024-36039). This vulnerability has been rated as having moderate security impact by Red Hat. The update is available for multiple Red Hat Enterprise Linux 8 variants and architectures.

A security update for Red Hat OpenStack Platform 16.2 addresses a vulnerability in python-gunicorn, a Python WSGI HTTP server. The vulnerability (CVE-2024-1135) involves HTTP Request Smuggling due to improper validation of Transfer-Encoding headers. Red Hat has rated this update as having an Important security impact and has released updated packages to fix the issue.

A security update for the fence-agents package in Red Hat Enterprise Linux addresses a vulnerability in the jinja2 component that improperly accepts keys containing non-attribute characters (CVE-2024-34064). The fence-agents scripts manage remote power control for cluster devices, enabling forced restart and removal of failed or unreachable nodes. Red Hat has rated this vulnerability as having a moderate security impact and has released an update for Red Hat Enterprise Linux 9 and its variants.

A moderate severity vulnerability (CVE-2024-22195) in the python-jinja2 package allows HTML attribute injection when user input is passed as keys to the xmlattr filter. This flaw affects the Jinja2 template engine used in Red Hat Enterprise Linux 8. A security update is available that addresses this issue. Users must apply the update and restart all applications using Jinja2 for the fix to take effect.

CVE-2024-0510 is a critical server-side request forgery (SSRF) vulnerability in HaoKeKeJi YiQiNiu versions 3.0 and 3.1. It affects the http_post function in the /application/pay/controller/Api.php file. An attacker can manipulate the 'url' argument to cause the server to make unauthorized requests. The vulnerability is remotely exploitable and has public exploit code disclosed. The CVSS 3.1 base score is 7.3, indicating high severity.