RHSA-2025:1335HighCVSS 7.5

Red Hat Security Advisory: RHUI 4.11 security, bugfix, and enhancement update

Published
February 12, 2025
Last Modified
October 16, 2026

🔗 CVE IDs covered (13)

CVE-2024-7246 →CVE-2024-39614 →CVE-2024-41989 →CVE-2024-41990 →CVE-2024-41991 →CVE-2024-26130 →CVE-2024-27306 →CVE-2024-30251 →CVE-2024-34064 →CVE-2024-35195 →CVE-2024-42005 →CVE-2024-1135 →CVE-2024-4340 →

📋 Description

CVE-2024-1135 — python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers CVE-2024-4340 — sqlparse: parsing heavily nested list leads to denial of service CVE-2024-7246 — grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the backend CVE-2024-26130 — python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override CVE-2024-27306 — aiohttp: XSS on index pages for static file handling CVE-2024-30251 — aiohttp: DoS when trying to parse malformed POST requests CVE-2024-34064 — jinja2: accepts keys containing non-attribute characters CVE-2024-35195 — requests: subsequent requests to the same host ignore cert verification CVE-2024-39614 — python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant() CVE-2024-41989 — python-django: Memory exhaustion in django.utils.numberformat.floatformat() CVE-2024-41990 — python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() CVE-2024-41991 — python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget CVE-2024-42005 — python-django: Potential SQL injection in QuerySet.values() and values_list()

🎯 Affected products200

  • RHUI 4 for RHEL 8
  • ansible-collection-community-crypto-0:2.21.1-1.el8ui.noarch as a component of RHUI 4 for RHEL 8
  • ansible-collection-community-crypto-0:2.21.1-1.el8ui.src as a component of RHUI 4 for RHEL 8
  • createrepo_c-0:1.1.3-1.0.1.el8ui.src as a component of RHUI 4 for RHEL 8
  • createrepo_c-debuginfo-0:1.1.3-1.0.1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • createrepo_c-debugsource-0:1.1.3-1.0.1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • createrepo_c-libs-0:1.1.3-1.0.1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • createrepo_c-libs-debuginfo-0:1.1.3-1.0.1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • libcomps-0:0.1.21-1.el8ui.src as a component of RHUI 4 for RHEL 8
  • libcomps-0:0.1.21-1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • libcomps-debuginfo-0:0.1.21-1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • libcomps-debugsource-0:0.1.21-1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • m2crypto-0:0.40.1-1.0.2.el8ui.src as a component of RHUI 4 for RHEL 8
  • m2crypto-debuginfo-0:0.40.1-1.0.2.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • m2crypto-debugsource-0:0.40.1-1.0.2.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • python-aiodns-0:3.0.0-7.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-aiofiles-0:22.1.0-5.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-aiohttp-0:3.9.4-1.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-aiohttp-debugsource-0:3.9.4-1.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • python-aiohttp-xmlrpc-0:1.5.0-6.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-aiosignal-0:1.3.1-5.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-asgiref-0:3.6.0-5.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-async-timeout-0:4.0.2-6.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-asyncio-throttle-0:1.0.2-7.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-attrs-0:21.4.0-6.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-backoff-0:2.2.1-5.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-brotli-0:1.0.9-6.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-brotli-debugsource-0:1.0.9-6.el8ui.x86_64 as a component of RHUI 4 for RHEL 8
  • python-certifi-0:2022.12.7-5.0.1.el8ui.src as a component of RHUI 4 for RHEL 8
  • python-charset-normalizer-0:2.1.1-5.el8ui.src as a component of RHUI 4 for RHEL 8
  • +170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions on how to apply this update, see: https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure For other information, see the product documentation: https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/4 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Do not accept user input as keys to the xmlattr filter without validation. See the statement above for more information. Workaround: Implementing input validation and limiting the the size of inputs to the urlize and urlizetrunc will mitigate this vulnerability.

🔗 References (19)