-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3544-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso April 07, 2016 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : python-django CVE ID : CVE-2016-2512 CVE-2016-2513 Debian Bug : 816434 Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2512 Mark Striemer discovered that some user-supplied redirect URLs containing basic authentication credentials are incorrectly handled, potentially allowing a remote attacker to perform a malicious redirect or a cross-site scripting attack. CVE-2016-2513 Sjoerd Job Postmus discovered that Django allows user enumeration through timing difference on password hasher work factor upgrades. For the oldstable distribution (wheezy), these problems have been fixed in version 1.4.5-1+deb7u16. For the stable distribution (jessie), these problems have been fixed in version 1.7.7-1+deb8u4. For the testing distribution (stretch), these problems have been fixed in version 1.9.4-1. For the unstable distribution (sid), these problems have been fixed in version 1.9.4-1. We recommend that you upgrade your python-django packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJXBoj5AAoJEAVMuPMTQ89E2NMP/RdAvzYeuYZxkgw+ATPqvA1F MRp+0iaLQJ8Lh75lP0D6mIWnflFnmr2MQp217vIU86ubm9w8YQYkOkQmtzb5HWDV afP+HBPUUWYv0g2LnjIXOzqkenaRYRFGDo4YMOUPwiMNsoPVwaGkCMZ7tAEivEQ1 8xm+G7Ugll9xO0odJXBZpzVHAVLYMHWpvHGcjDENLmaxl/3Y1KVmVwhD+olLVXDP DP9Ow1Eprt0dPwEsJoAyY870T5a5BHp4cl5hSIVF5rm1dQ+i4RxVpish2dRSyicE E7JiaY9kYzHP2AYxQyPkjBPGf5Zx3t31asfiojJoNmsa57UJrjtWzVODmRgFgXuR GfhAmMdZ+HYDzAA0KYNR/2BJP7i/Zccr0lZsPGNX9aqfPQKKFAt4ZrDiQjasLMVV dTTr7hebQjQjRp98CJAa8UHrY6xmL7ifYy5YiBqmn9+jNiAOChB5sL8bxrtcbEJV IZPYA2D8IxRDstTQ/S0KcH5UKMUYIheaCdoC9WG+ohwALghAealU2yQ6g6fq8nTL tqnDWbEDq4cl07zlvsvZteDQUG/tmM0zc4WriKqjaj3SKiUy73OWPLN3cQX9S8Go BSf2v4xUhR5cpwEk/yqifZZPmocAfKOJItT9ci3lt2Bfs4H1e0eXS1yiPFTVpyUx cSbrxvB8fj1zAqS4Ur9p =NSZQ -----END PGP SIGNATURE-----