full-disclosure - [ MDVSA-2011:031 ] python-django

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1PqYWW-0005jS-I9@titan.mandriva.com>
Date: Fri, 18 Feb 2011 23:10:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2011:031 ] python-django

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:031
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : python-django
 Date    : February 18, 2011
 Affected: 2010.0, 2010.1
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in python-django:

 Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly
 validate HTTP requests that contain an X-Requested-With header,
 which makes it easier for remote attackers to conduct cross-site
 request forgery (CSRF) attacks via forged AJAX requests that leverage
 a combination of browser plugins and redirects, a related issue to
 CVE-2011-0447 (CVE-2011-0696).

 Cross-site scripting (XSS) vulnerability in Django 1.1.x before
 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject
 arbitrary web script or HTML via a filename associated with a file
 upload (CVE-2011-0697).

 Directory traversal vulnerability in Django 1.1.x before 1.1.4 and
 1.2.x before 1.2.5 on Windows might allow remote attackers to read or
 execute files via a / (slash) character in a key in a session cookie,
 related to session replays (CVE-2011-0698).

 The updated packages have been upgraded to the 1.1.4 version which
 is not vulnerable to these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0696
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0697
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0698
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.0:
 202f769807a186f2d9197c9eda30faa6  2010.0/i586/python-django-1.1.4-0.1mdv2010.0.noarch.rpm 
 ba04206d09a47c76d3e5b0e60dbad79f  2010.0/SRPMS/python-django-1.1.4-0.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 33eb96488eced9ae1d573bb6f2706058  2010.0/x86_64/python-django-1.1.4-0.1mdv2010.0.noarch.rpm 
 ba04206d09a47c76d3e5b0e60dbad79f  2010.0/SRPMS/python-django-1.1.4-0.1mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 3cfc441c4f75142c19416c6f6d22eb2d  2010.1/i586/python-django-1.1.4-0.1mdv2010.2.noarch.rpm 
 4f628f112373a36feebb403daec0e646  2010.1/SRPMS/python-django-1.1.4-0.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 50a8a8aad7dd3001bee2560f8df1b156  2010.1/x86_64/python-django-1.1.4-0.1mdv2010.2.noarch.rpm 
 4f628f112373a36feebb403daec0e646  2010.1/SRPMS/python-django-1.1.4-0.1mdv2010.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNXsGvmqjQ0CJFipgRAggbAKC6jBSLeNUZCFYKefNU6S5mo4G+QgCeLdLo
ksEbjuDpyvINyjhBj/kj17s=
=QCYL
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/