Bug 2497328 (CVE-2026-53877)
| Summary: | CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, ehelms, ggainey, jlanda, jmitchel, jpasqual, juwatts, jwong, kaycoth, kshier, lcouzens, mhulan, nmoumoul, omaciel, osousa, pcreech, rchan, security-response-team, simaishi, smallamp, stcannon, teagle, tmalecek, ttakamiy, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Django. Instantiating django.contrib.gis.gdal.GDALRaster with a bytes object representing a raster file can trigger a heap buffer over-read in the vsi_buffer property, reading roughly 32 bytes past the end of the allocated buffer. An attacker who can supply crafted raster data may cause disclosure of adjacent heap memory or, in rare cases, crash the application process.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2026-07-07 | ||
| Attachments: | |||
|
Description
OSIDB Bzimport
2026-07-06 11:43:25 UTC
Created attachment 2147812 [details]
0002-5.2.x-Fixed-CVE-2026-53877-Prevented-heap-buffer-ove.patch
Created attachment 2147813 [details]
0002-6.0.x-Fixed-CVE-2026-53877-Prevented-heap-buffer-ove.patch
Created attachment 2147814 [details]
0002-6.1.x-Fixed-CVE-2026-53877-Prevented-heap-buffer-ove.patch
Created attachment 2147815 [details]
0002-Fixed-CVE-2026-53877-Prevented-heap-buffer-over-read.patch
|