Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

SUSE: 2018:1828-1 Moderate: Python-Django Phishing and Backtracking Issues

suse
Calendar Grey June 27, 2018
Scroller Suse
SUSE has released a Security Update for python-Django addressing multiple security vulnerabilities, including issues related to phishing attempts and XSS attacks.
An update that fixes three vulnerabilities is now available

Summary

This update for python-Django fixes the following security issues: - CVE-2016-2512: The utils.http.is_safe_url function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication (bsc#967999). - CVE-2018-7536: The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities (bsc#1083304) - CVE-2018-7537: If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression (bsc#1083305) Patch Instructions:

Topics%20covered

Topics Covered

security advisory moderate XSS phishing SUSE python-Django catastrophic backtracking

References

#1083304 #1083305 #967999

Cross- CVE-2016-2512 CVE-2018-7536 CVE-2018-7537

Affected Products:

SUSE Enterprise Storage 4

https://www.suse.com/security/cve/CVE-2016-2512.html

https://www.suse.com/security/cve/CVE-2018-7536.html

https://www.suse.com/security/cve/CVE-2018-7537.html

https://bugzilla.suse.com/1083304

https://bugzilla.suse.com/1083305

https://bugzilla.suse.com/967999

Announcement ID: SUSE-SU-2018:1828-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate XSS phishing SUSE python-Django catastrophic backtracking

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.