bugtraq - [SECURITY] [DSA 3230-1] django-markupfield security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20150420090709.5077052F@bendel.debian.org>
Date: Mon, 20 Apr 2015 11:06:52 +0200
From: Alessandro Ghedini <ghedo@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3230-1] django-markupfield security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3230-1                   security@...ian.org
http://www.debian.org/security/                        Alessandro Ghedini
April 20, 2015                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : django-markupfield
CVE ID         : CVE-2015-0846

James P. Turk discovered that the ReST renderer in django-markupfield,
a custom Django field for easy use of markup in text fields, didn't
disable the ..raw directive, allowing remote attackers to include
arbitrary files.

For the stable distribution (wheezy), this problem has been fixed in
version 1.0.2-2+deb7u1.

For the upcoming stable distribution (jessie), this problem has been
fixed in version 1.2.1-2+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 1.3.2-1.

We recommend that you upgrade your django-markupfield packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVNMGsAAoJEK+lG9bN5XPLWcQP/2Qf5DXMNxmhmkJX68HjQQqe
iCus9VNice9FhkQet8oYkCLFfFcHRD1ifnVtRVs14fxnuh2DrjhVceaHJnGPnUs9
xJOLxHcRnDPlqeh+NlwZKIjSMFcZHtat6FnO9Tc2V6mmWBhWPv3f5ZJkpJeLqqgW
KFxT2T1nTHTKXvjwxD2NbL3eUXic1N5gyI6FtG22//IfX32ECTHUkoHlqtlYj29M
AcB5LTQcsQLMd8QVaox1ldhkYw+wOi6Jav0VBdjCDOn+FXpeUc+EqAugZrUfz/5H
rzx2EyWWzzUy6cnQXrM1U1X7xt5WLHfjmL3ZOVmNWNUwDh3F4YIkmMR8tMcebmVg
qRo44Hng0aDU9HsCp5Gp2gepipTlz7YtKUpcNlyj99BzNIXtyNyB6SY1wQ7Hb5/f
7Ak1RKbpfnx+krioAsu0eTLv8EKYcXLu8ma2YMmy9iI8JabCIto7JwNxqbDV0hUa
7ETcS9iGrFbINzICC3si7TeQ6/DdqKIAf8F0ozQvadQM8s0jOVCLP30ovWdIDuvh
6wHkmBJ0BCm+J0NnRXe3cZABTEhkUvRHZ1Z0BZOueEfn6HLfDX6B5VPAf3pbvfa3
QiyidqZ/9JMRZjH9q2kGM2b9uSp0SVKwsusq8YlefnH5pCvXfmRta4sqptbJkw/f
O1nsdS56lZFhtyrbp7Gg
=hRsD
-----END PGP SIGNATURE-----