Werkzeug is a WSGI utility module. It includes a debugger, request and
response objects, HTTP utilities to handle entity tags, cache control
headers, HTTP dates, cookie handling, file uploads, a URL routing system
and a numerous community contributed add-on modules. Werkzeug is unicode
aware and does not enforce a specific template engine, database adapter or
a specific way of handling requests. It is useful for end user
applications, such as blogs, wikis, and bulletin boards, that need to
operate in a wide variety of server environments.
Security Fix(es):
* user may execute code on a developer's machine (CVE-2024-34069)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.49. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHSA-2024:6009
Security Fix(es):
* jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
The function has been refined to reject such strings without the associated resource consumption in version 3.7.
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
### References
* https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb
An ansible-core rebuild for OpenStack based on python 3.9.
Security Fix(es):
* HTML attribute injection when passing user input as keys to xmlattr
filter (CVE-2024-22195)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.