Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Sign up!
EnGarde Community
What is the most important Linux security technology?
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Latest Newsletters
Linux Advisory Watch: March 27th, 2015
Linux Security Week: March 23rd, 2015
LinuxSecurity Newsletters
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

Debian: 3010-1: python-django: Summary Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Security Report Summary
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3010-1                               Salvatore Bonaccorso
August 22, 2014              
- -------------------------------------------------------------------------

Package        : python-django
CVE ID         : CVE-2014-0480 CVE-2014-0481 CVE-2014-0482 CVE-2014-0483

Several vulnerabilities were discovered in Django, a high-level Python
web development framework. The Common Vulnerabilities and Exposures
project identifies the following problems:


    Florian Apolloner discovered that in certain situations, URL
    reversing could generate scheme-relative URLs which could
    unexpectedly redirect a user to a different host, leading to
    phishing attacks.


    David Wilson reported a file upload denial of service vulnerability.
    Django's file upload handling in its default configuration may
    degrade to producing a huge number of `os.stat()` system calls when
    a duplicate filename is uploaded. A remote attacker with the ability
    to upload files can cause poor performance in the upload handler,
    eventually causing it to become very slow.


    David Greisen discovered that under some circumstances, the use of
    the RemoteUserMiddleware middleware and the RemoteUserBackend
    authentication backend could result in one user receiving another
    user's session, if a change to the REMOTE_USER header occurred
    without corresponding logout/login actions.


    Collin Anderson discovered that it is possible to reveal any field's
    data by modifying the "popup" and "to_field" parameters of the query
    string on an admin change form page. A user with access to the admin
    interface, and with sufficient knowledge of model structure and the
    appropriate URLs, could construct popup views which would display
    the values of non-relationship fields, including fields the
    application developer had not intended to expose in such a fashion.

For the stable distribution (wheezy), these problems have been fixed in
version 1.4.5-1+deb7u8.

For the unstable distribution (sid), these problems have been fixed in
version 1.6.6-1.

We recommend that you upgrade your python-django packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:

Mailing list:
< Prev   Next >


Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
FBI Quietly Removes Recommendation To Encrypt Your Phone
And the prize for LEAST SECURE BROWSER goes to ... Chrome!
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2015 Guardian Digital, Inc. All rights reserved.