Security update for python-django SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0563-1 Final 1 1 2014-09-03T15:51:02Z current 2014-09-03T15:51:02Z 2014-09-03T15:51:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-django python-django was updated to 1.5.10 fixing bugs and security issues: * Prevented reverse() from generating URLs pointing to other hosts to prevent phishing attacks. (bnc#893087, CVE-2014-0480) * Removed O(n) algorithm when uploading duplicate file names to fix file upload denial of service. (bnc#893088, CVE-2014-0481) * Modified RemoteUserMiddleware to logout on REMOTE_USE change to prevent session hijacking. (bnc#893089, CVE-2014-0482) * Prevented data leakage in contrib.admin via query string manipulation. (bnc#893090, CVE-2014-0483) Security Issues: * CVE-2014-0480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480> * CVE-2014-0481 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481> * CVE-2014-0482 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482> * CVE-2014-0483 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo40sp3-python-django Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ Link for SUSE-SU-2015:0563-1 https://lists.suse.com/pipermail/sle-security-updates/2015-March/001310.html E-Mail link for SUSE-SU-2015:0563-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/893087 SUSE Bug 893087 https://bugzilla.suse.com/893088 SUSE Bug 893088 https://bugzilla.suse.com/893089 SUSE Bug 893089 https://bugzilla.suse.com/893090 SUSE Bug 893090 https://bugzilla.suse.com/913053 SUSE Bug 913053 https://bugzilla.suse.com/913054 SUSE Bug 913054 https://bugzilla.suse.com/913055 SUSE Bug 913055 https://bugzilla.suse.com/913056 SUSE Bug 913056 https://bugzilla.suse.com/914706 SUSE Bug 914706 https://bugzilla.suse.com/923176 SUSE Bug 923176 https://www.suse.com/security/cve/CVE-2014-0480/ SUSE CVE CVE-2014-0480 page https://www.suse.com/security/cve/CVE-2014-0481/ SUSE CVE CVE-2014-0481 page https://www.suse.com/security/cve/CVE-2014-0482/ SUSE CVE CVE-2014-0482 page https://www.suse.com/security/cve/CVE-2014-0483/ SUSE CVE CVE-2014-0483 page https://www.suse.com/security/cve/CVE-2015-0219/ SUSE CVE CVE-2015-0219 page https://www.suse.com/security/cve/CVE-2015-0220/ SUSE CVE CVE-2015-0220 page https://www.suse.com/security/cve/CVE-2015-0221/ SUSE CVE CVE-2015-0221 page https://www.suse.com/security/cve/CVE-2015-0222/ SUSE CVE CVE-2015-0222 page https://www.suse.com/security/cve/CVE-2015-2316/ SUSE CVE CVE-2015-2316 page https://www.suse.com/security/cve/CVE-2015-2317/ SUSE CVE CVE-2015-2317 page SUSE OpenStack Cloud 4 python-django-1.5.10-0.11.1 python-django-1.5.10-0.11.1 as a component of SUSE OpenStack Cloud 4 The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. CVE-2014-0480 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2014-0480.html CVE-2014-0480 https://bugzilla.suse.com/893087 SUSE Bug 893087 https://bugzilla.suse.com/919763 SUSE Bug 919763 The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. CVE-2014-0481 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2014-0481.html CVE-2014-0481 https://bugzilla.suse.com/893088 SUSE Bug 893088 https://bugzilla.suse.com/919763 SUSE Bug 919763 The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header. CVE-2014-0482 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2014-0482.html CVE-2014-0482 https://bugzilla.suse.com/893089 SUSE Bug 893089 https://bugzilla.suse.com/919763 SUSE Bug 919763 The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. CVE-2014-0483 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2014-0483.html CVE-2014-0483 https://bugzilla.suse.com/893090 SUSE Bug 893090 https://bugzilla.suse.com/919763 SUSE Bug 919763 Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header. CVE-2015-0219 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-0219.html CVE-2015-0219 https://bugzilla.suse.com/913053 SUSE Bug 913053 https://bugzilla.suse.com/919763 SUSE Bug 919763 The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL. CVE-2015-0220 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-0220.html CVE-2015-0220 https://bugzilla.suse.com/913054 SUSE Bug 913054 https://bugzilla.suse.com/919763 SUSE Bug 919763 The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file. CVE-2015-0221 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-0221.html CVE-2015-0221 https://bugzilla.suse.com/913056 SUSE Bug 913056 https://bugzilla.suse.com/919763 SUSE Bug 919763 ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries. CVE-2015-0222 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-0222.html CVE-2015-0222 https://bugzilla.suse.com/913055 SUSE Bug 913055 https://bugzilla.suse.com/919763 SUSE Bug 919763 The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. CVE-2015-2316 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-2316.html CVE-2015-2316 https://bugzilla.suse.com/923172 SUSE Bug 923172 The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. CVE-2015-2317 SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/ https://www.suse.com/security/cve/CVE-2015-2317.html CVE-2015-2317 https://bugzilla.suse.com/923176 SUSE Bug 923176