[RHSA-2022:5738-01] Important: Django 3.2.14 Security Update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Django 3.2.14 Security Update
Advisory ID:       RHSA-2022:5738-01
Product:           Red Hat Update Infrastructure
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5738
Issue date:        2022-07-27
CVE Names:         CVE-2022-34265 
=====================================================================

1. Summary:

A security fix for a CVE in the Django library is now available.

2. Relevant releases/architectures:

RHUI 4 for RHEL 8 - noarch

3. Description:

Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly
redundant framework that enables you to manage repositories and content. It
also enables cloud providers to deliver content and updates to Red Hat
Enterprise Linux (RHEL) instances.

Security Fix:
* Django: Potential SQL injection via Trunc(kind) and Extract(lookup_name)
arguments (CVE-2022-34265)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Users of RHUI are advised to upgrade to this updated package that fixes
this bug.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

RHUI services must be restarted for this update to take effect. To restart
them, run the following command on the RHUA node as root:

# rhui-services-restart

For other information, consult the product documentation at:
https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4

5. Bugs fixed (https://bugzilla.redhat.com/):

2102896 - CVE-2022-34265 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments

6. Package List:

RHUI 4 for RHEL 8:

Source:
python-django-3.2.14-3.el8ui.src.rpm

noarch:
python38-django-3.2.14-3.el8ui.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-34265
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuqtDdzjgjWX9erEAQir4RAAlYKH81dsuMoOgARazcIqh6M28iacmGQL
/8Ey7enfjxLizIX0cTo8qeu36aEUIooFQqBUAMHr9QuvWa5Tp4Gy6y7SkL/8FGRK
ECv2gEV1H4osWZT/K9YiJdQ/gJ1vHbdst04eUshYY9MSYvxAKG6yxheGuRXnbiWK
r9YHT1+U4fbLX9KcQJjfRTtG3MTyzhxnthQXE4ryfOtaUOQhWuqJdOVfvmlpw7qn
MnDN3RU+2l3kZb7FWHtJmurI63WIPSoVuBJjaB42HqyiS0aAg5L9Z2DoBQzEN9G6
9wX8aK07iUjR0uifr+GcYgX7HdRYeRPWc2hdb3BHhPIPNgw08yqv7+junSDSJFAE
PES6Y3nOu3NMIT2grWpXKNQaFsUt/HfFe4DgRT76sFUqyzvDL6gsNn3SAvLwElkH
uEw4TYAFZYdtPj44/yT2aIFjxmUdR/qsiin78PyhbDYPhq4DU2XhejtWDlPcIvja
cVUBIntS8NPxC56dcEuMNinXfLgjqFwnGNAeNik9pDb9ChOVM6K7E/M6bxETO8PW
y7H+tN4XBUq2w3nazmVfn+QuMc3rsrTpOlEtBI/iw8D3j2R/2XqRzI9BrpVhQPfA
xZ6NMPXEepy2UIMbuR4IQXYJAxnN2ReuYidbbhwmoB1AXZ8vhH87p8xY/jeEOxmL
WrXjMxEyeoo=
=sAgT
-----END PGP SIGNATURE-----