python310-django-ckeditor-6.7.2-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14557-1 Final 1 1 2024-12-06T00:00:00Z current 2024-12-06T00:00:00Z 2024-12-06T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python310-django-ckeditor-6.7.2-1.1 on GA media These are all security issues fixed in the python310-django-ckeditor-6.7.2-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14557 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTZL2Q6MD2MZXWLTDIWGVIWV5USTFGZF/ E-Mail link for openSUSE-SU-2024:14557-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-24815/ SUSE CVE CVE-2024-24815 page openSUSE Tumbleweed python310-django-ckeditor-6.7.2-1.1 python311-django-ckeditor-6.7.2-1.1 python312-django-ckeditor-6.7.2-1.1 python313-django-ckeditor-6.7.2-1.1 python310-django-ckeditor-6.7.2-1.1 as a component of openSUSE Tumbleweed python311-django-ckeditor-6.7.2-1.1 as a component of openSUSE Tumbleweed python312-django-ckeditor-6.7.2-1.1 as a component of openSUSE Tumbleweed python313-django-ckeditor-6.7.2-1.1 as a component of openSUSE Tumbleweed CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. CVE-2024-24815 openSUSE Tumbleweed:python310-django-ckeditor-6.7.2-1.1 openSUSE Tumbleweed:python311-django-ckeditor-6.7.2-1.1 openSUSE Tumbleweed:python312-django-ckeditor-6.7.2-1.1 openSUSE Tumbleweed:python313-django-ckeditor-6.7.2-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LTZL2Q6MD2MZXWLTDIWGVIWV5USTFGZF/ https://www.suse.com/security/cve/CVE-2024-24815.html CVE-2024-24815 https://bugzilla.suse.com/1219720 SUSE Bug 1219720