bugtraq - [SECURITY] [DSA 3151-1] python-django security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1YIWfH-0002FQ-0l@master.debian.org>
Date: Tue, 03 Feb 2015 06:08:47 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3151-1] python-django security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3151-1                   security@...ian.org
http://www.debian.org/security/                      Salvatore Bonaccorso
February 03, 2015                      http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : python-django
CVE ID         : CVE-2015-0219 CVE-2015-0220 CVE-2015-0221
Debian Bug     : 775375

Several vulnerabilities were discovered in Django, a high-level Python
web development framework. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2015-0219

    Jedediah Smith reported that the WSGI environ in Django does not
    distinguish between headers containing dashes and headers containing
    underscores. A remote attacker could use this flaw to spoof WSGI
    headers.

CVE-2015-0220

    Mikko Ohtamaa discovered that the django.util.http.is_safe_url()
    function in Django does not properly handle leading whitespaces in
    user-supplied redirect URLs. A remote attacker could potentially use
    this flaw to perform a cross-site scripting attack.

CVE-2015-0221

    Alex Gaynor reported a flaw in the way Django handles reading files
    in the django.views.static.serve() view. A remote attacker could
    possibly use this flaw to mount a denial of service via resource
    consumption.

For the stable distribution (wheezy), these problems have been fixed in
version 1.4.5-1+deb7u9.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 1.7.1-1.1.

For the unstable distribution (sid), these problems have been fixed in
version 1.7.1-1.1.

We recommend that you upgrade your python-django packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJU0GWsAAoJEAVMuPMTQ89EFeMP/iiS/4pddHp8SxjYh5dvNoUY
kbMF2qgi3fDowVnEnN3W+jf6b6PoM64jCY7Rd1cA9IUnFK/dqb8v9UckOVpiuucp
dGy1jH2cNPjpfRFZ2HO0cPBmg6iSeP3DDSbCPUAHj5CBBq9jH6td54nBid1GHIoI
tnCA1VlvMy1bi81dduA+rdDliEA3ekegYIrQi4IdgyOHWTxJyaOYLW1XVH15I3cy
m7h9QI6q6Pi1uuxK4lZaT8U25k6p7izF0ohY/3ojKl3pEP5nJhY9UiqP1+io/ofK
Q9BBJzfHO3Rzaj9o6iiSoTD+aP7pKxQ8Me77MGWHhXFEH7gJFVq6G/xlWlNWIdym
BItrm1MZQOSxb+/GyMoNkO3wARTlDNrAHJot+z8L1J9/r7nl+iC1hdU33YeYYLF2
FHd8Gj2tyks4y+h4RkiJlBUyz6JcCDzwaLhUY6/YerPx5c4d9WPtjYA0+YcE+1jE
yb/vPmthtZxkuO7fXN+nULgChunaUJqXQarsfIO5d2ghEDFQyOBmodNejUZqrA/o
EWoGxwLmmzDOewPWGt4tRm0fOiBnZULLVscCqSq8EFSmdvjACSlYgD1GsCcn0zYs
Ql6lds8VfEQFh5p/1GzUDMGDvsn9GuL4YW7iohSX6MEcT0lyFZ+G6un9yKu+G559
HPRD8AtorJgek7dnxlS4
=wgjP
-----END PGP SIGNATURE-----