Ubuntu: 12.10, 12.04 LTS, 11.10, 10.04 LTS: Critical Django Issues

ubuntu

March 7, 2013

Several security issues were fixed in Django.

Summary

Several security issues were fixed in Django.

Software Description:

- python-django: High-level Python web development framework

Details:

James Kettle discovered that Django did not properly filter the Host HTTP

header when processing certain requests. An attacker could exploit this to

generate and display arbitrary URLs to users. Although this issue had been

previously addressed in USN-1632-1, this update adds additional hardening

measures to host header validation. This update also adds a new

ALLOWED_HOSTS setting that can be set to a list of acceptable values for

headers. (CVE-2012-4520)

Orange Tsai discovered that Django incorrectly performed permission checks

when displaying the history view in the admin interface. An administrator

could use this flaw to view the history of any object, regardless of

intended permissions. (CVE-2013-0305)

It was discovered that Django incorrectly handled a large number of forms

when generating formsets. An attacker cou...

Read the Full Advisory

Topics Covered

security advisory denial of service python-django host header permission checks

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-django                   1.4.1-2ubuntu0.3

Ubuntu 12.04 LTS:
  python-django                   1.3.1-4ubuntu1.6

Ubuntu 11.10:
  python-django                   1.3-2ubuntu1.6

Ubuntu 10.04 LTS:
  python-django                   1.1.1-2ubuntu1.8

In general, a standard system update will make all the necessary changes.