openSUSE-SU-2025:0008-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2025:0008-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2025:0008-1
Related
Published
2025-01-07T17:02:06Z
Modified
2025-01-07T17:02:06Z
Summary
Security update for python-django-ckeditor
Details

This update for python-django-ckeditor fixes the following issues:

  • Update to 6.7.2
    • Deprecated the package.
    • Added a new ckeditor/fixups.js script which disables the version check again (if something slips through by accident) and which disables the behavior where CKEditor 4 would automatically attach itself to unrelated HTML elements with a contenteditable attribute (see CKEDITOR.disableAutoInline in the CKEditor 4 docs).
  • CVE-2024-24815: Fixed bypass of Advanced Content Filtering mechanism (boo#1219720)

  • update to 6.7.1:

    • Add Python 3.12, Django 5.0
    • Silence the CKEditor version check/nag but include a system check warning
  • update to 6.7.0:

    • Dark mode fixes.
    • Added support for Pillow 10.
  • update to 6.6.1:

    • Required a newer version of django-js-asset which actually works with Django 4.1.
    • CKEditor 4.21.0
    • Fixed the CKEditor styles when used with the dark Django admin theme.
  • update to 6.5.1:

    • Avoided calling static() if CKEDITOR_BASEPATH is defined.
    • Fixed ./manage.py generateckeditorthumbnails to work again after the image uploader backend rework.
    • CKEditor 4.19.1
    • Stopped calling static() during application startup.
    • Added Django 4.1
    • Changed the context for the widget to deviate less from Django. Removed a
    • few template variables which are not used in the bundled
    • ckeditor/widget.html template. This only affects you if you are using a
    • customized widget or widget template.
    • Dropped support for Python < 3.8, Django < 3.2.
    • Added a pre-commit configuration.
    • Added a GitHub action for running tests.
    • Made selenium tests require opt in using a SELENIUM=firefox or SELENIUM=chromium environment variable.
    • Made it possible to override the CKEditor template in the widget class.
    • Changed CKEDITOR_IMAGE_BACKEND to require dotted module paths (the old identifiers are still supported for now).
References

Affected packages

SUSE:Package Hub 15 SP5 / python-django-ckeditor

Package

Name
python-django-ckeditor
Purl
pkg:rpm/suse/python-django-ckeditor&distro=SUSE%20Package%20Hub%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.2-bp155.3.3.1

Ecosystem specific

{
    "binaries": [
        {
            "python311-django-ckeditor": "6.7.2-bp155.3.3.1"
        }
    ]
}

openSUSE:Leap 15.5 / python-django-ckeditor

Package

Name
python-django-ckeditor
Purl
pkg:rpm/opensuse/python-django-ckeditor&distro=openSUSE%20Leap%2015.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.7.2-bp155.3.3.1

Ecosystem specific

{
    "binaries": [
        {
            "python311-django-ckeditor": "6.7.2-bp155.3.3.1"
        }
    ]
}