Debian: DSA-3010-1 Critical: Python-Django Phishing And DoS

CVE-2014-0480

Florian Apolloner discovered that in certain situations, URL
reversing could generate scheme-relative URLs which could
unexpectedly redirect a user to a different host, leading to
phishing attacks.

CVE-2014-0481

David Wilson reported a file upload denial of service vulnerability.
Django's file upload handling in its default configuration may
degrade to producing a huge number of `os.stat()` system calls when
a duplicate filename is uploaded. A remote attacker with the ability
to upload files can cause poor performance in the upload handler,
eventually causing it to become very slow.

CVE-2014-0482

David Greisen discovered that under some circumstances, the use of
the RemoteUserMiddleware middleware and the RemoteUserBackend
authentication backend could result in one user receiving another
user's session, if a change to the REMOTE_USER header occurred
without corresponding logout/login actions.

CVE-2014-0483

Collin Anderson di...