openSUSE Security Update: Security update for python-django-ckeditor
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2025:0008-1
Rating:             moderate
References:         #1219720 
Cross-References:   CVE-2024-24815
Affected Products:
                    openSUSE Backports SLE-15-SP5
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for python-django-ckeditor fixes the following issues:

   - Update to 6.7.2
     * Deprecated the package.
     * Added a new ckeditor/fixups.js script which disables the version check
       again (if something slips through by accident) and which disables the
       behavior where CKEditor 4 would automatically attach itself to
       unrelated HTML elements with a contenteditable attribute (see
       CKEDITOR.disableAutoInline in the CKEditor 4 docs).
   - CVE-2024-24815: Fixed bypass of Advanced Content Filtering mechanism
     (boo#1219720)

   - update to 6.7.1:
     * Add Python 3.12, Django 5.0
     * Silence the CKEditor version check/nag but include a system check
       warning

   - update to 6.7.0:
     * Dark mode fixes.
     * Added support for Pillow 10.

   - update to 6.6.1:
     * Required a newer version of django-js-asset which actually works with
       Django 4.1.
     * CKEditor 4.21.0
     * Fixed the CKEditor styles when used with the dark Django admin theme.

   - update to 6.5.1:
     * Avoided calling ``static()`` if ``CKEDITOR_BASEPATH`` is defined.
     * Fixed ``./manage.py generateckeditorthumbnails`` to work again after
       the image uploader backend rework.
     * CKEditor 4.19.1
     * Stopped calling ``static()`` during application startup.
     * Added Django 4.1
     * Changed the context for the widget to deviate less from Django.
       Removed a
     * few template variables which are not used in the bundled
     * ``ckeditor/widget.html`` template. This only affects you if you are
       using a
     * customized widget or widget template.
     * Dropped support for Python < 3.8, Django < 3.2.
     * Added a pre-commit configuration.
     * Added a GitHub action for running tests.
     * Made selenium tests require opt in using a ``SELENIUM=firefox`` or
       ``SELENIUM=chromium`` environment variable.
     * Made it possible to override the CKEditor template in the widget class.
     * Changed ``CKEDITOR_IMAGE_BACKEND`` to require dotted module paths (the
       old identifiers are still supported for now).


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP5:

      zypper in -t patch openSUSE-2025-8=1



Package List:

   - openSUSE Backports SLE-15-SP5 (noarch):

      python311-django-ckeditor-6.7.2-bp155.3.3.1


References:

   https://www.suse.com/security/cve/CVE-2024-24815.html
   https://bugzilla.suse.com/1219720