Ubuntu 1967-1 Security Advisory: Critical Django Issues and Fixes

ubuntu

September 24, 2013

Several security issues were fixed in Django.

Summary

Several security issues were fixed in Django.

Software Description:

- python-django: High-level Python web development framework

Details:

It was discovered that Django incorrectly handled large passwords. A remote

attacker could use this issue to consume resources, resulting in a denial

of service. (CVE-2013-1443)

It was discovered that Django incorrectly handled ssi templates. An

attacker could use this issue to read arbitrary files. (CVE-2013-4315)

It was discovered that the Django is_safe_url utility function did not

restrict redirects to certain schemes. An attacker could possibly use this

issue to perform a cross-site scripting attack.

Topics Covered

security advisory denial of service cross-site scripting remote attack ubuntu django ssi template issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  python-django                   1.4.5-1ubuntu0.1

Ubuntu 12.10:
  python-django                   1.4.1-2ubuntu0.4

Ubuntu 12.04 LTS:
  python-django                   1.3.1-4ubuntu1.8

Ubuntu 10.04 LTS:
  python-django                   1.1.1-2ubuntu1.9

In general, a standard system update will make all the necessary changes.