Gentoo Linux Security Advisory 201406-26 - Multiple vulnerabilities have been found Django, the worst of which may allow a remote attacker to execute code. Versions less than 1.6.5 are affected.
404e02910f0bba73ffd124d38235026d2d6b71b9979c90bfa6cd369b3b9e7d66Mandriva Linux Security Advisory 2014-113 - Multiple vulnerabilities has been discovered and corrected in python-django. The updated packages have been patched to correct these issues.
a0587e94d3219db2c4fe7c8b06b39629a3d11277e9a9b81cdc8369f36837bd43Mandriva Linux Security Advisory 2014-112 - Multiple vulnerabilities has been discovered and corrected in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. Various other issues were also addressed. The updated packages have been patched to correct these issues.
f520b2a1af54463c5702534c185216ba941c354cf4597245c36aca5f2c74ab96Debian Linux Security Advisory 2934-1 - Several vulnerabilities were discovered in Django, a high-level Python web development framework.
f3cac867348584be5c7e3a98278d62b519f5059a1407c982fa0160a95cfab217Red Hat Security Advisory 2014-0456-01 - The Django web framework is used by horizon, the OpenStack Dashboard, which is a web interface for managing OpenStack services. A flaw was found in the way Django's reverse() URL resolver function constructed certain URLs. A remote attacker able to request a specially crafted view from a Django application could use this flaw to import and execute arbitrary Python modules on the system under the privileges of the user running the application. It was found that Django's caching framework reused Cross-Site Request Forgery nonces for all requests from unauthenticated clients. A remote attacker could use this flaw to acquire the CSRF token of a different user and bypass intended CSRF protections in a Django application.
7d3d6cad65001a8d8ce3aed0cdd68bb6511642305037b7f18a9d175c24eaa539Red Hat Security Advisory 2014-0457-01 - The Django web framework is used by horizon, the OpenStack Dashboard, which is a web interface for managing OpenStack services. A flaw was found in the way Django's reverse() URL resolver function constructed certain URLs. A remote attacker able to request a specially crafted view from a Django application could use this flaw to import and execute arbitrary Python modules on the system under the privileges of the user running the application. It was found that Django's caching framework reused Cross-Site Request Forgery nonces for all requests from unauthenticated clients. A remote attacker could use this flaw to acquire the CSRF token of a different user and bypass intended CSRF protections in a Django application.
1c5de234299b01654c159b4821380dc69ec031a26258631ae3e1ed304d8096fbUbuntu Security Notice 2169-2 - USN-2169-1 fixed vulnerabilities in Django. The upstream security patch for CVE-2014-0472 introduced a regression for certain applications. This update fixes the problem. Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. Michael Koziarski discovered that Django did not always perform explicit conversion of certain fields when using a MySQL database. An attacker could possibly use this issue to obtain unexpected results. Various other issues were also addressed.
a7b08008b8314bc324c3bac2dbe355fbb780f90950b9918e89cde30052b8e26eUbuntu Security Notice 2169-1 - Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() function. An attacker could use this issue to cause Django to import arbitrary modules from the Python path, resulting in possible code execution. Paul McMillan discovered that Django incorrectly cached certain pages that contained CSRF cookies. An attacker could possibly use this flaw to obtain a valid cookie and perform attacks which bypass the CSRF restrictions. Various other issues were also addressed.
c06fe39660153662ccdc26aee4797b8b2cc6dc27ae9d5dcc5eacfa238b42bcac
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed