Snyk Security Database

ksp-client-registry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to the get_supported_language_variant() function in django/utils/translation/trans_real.py. An attacker can exhaust process memory by sending many distinct, very long language codes that are cached as lru_cache keys before the length check is applied. This can grow the in-memory cache with attacker-controlled values and degrade or crash a Django process handling requests that supply language codes.

com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform.

Affected versions of this package are vulnerable to Improper Input Validation via the client process. An attacker can read arbitrary memory from any cluster member, potentially access sensitive data, cause cluster members to crash, or corrupt memory contents, which may lead to remote code execution, by sending crafted requests from a low-privileged client.

** Notes: **

• Additional fixed versions are available for enterprise users in 5.6.1 / 5.5.10 / 5.4.5.