Stay Secure with the Latest Linux Advisories

security advisorydenial of servicecross-site scripting

Ubuntu 1967-1 Security Advisory: Critical Django Issues and Fixes

Several security issues were fixed in Django.. =========================================================================Ubuntu Security Notice USN-1967-1 September 24, 2013 python-django vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in Django. Software Description: - python-django: High-level Python web development framework Details: It was discovered that Django incorrectly handled large passwords. A remote attacker could use this issue to consume resources, resulting in a denial of service. (CVE-2013-1443) It was discovered that Django incorrectly handled ssi templates. An attacker could use this issue to read arbitrary files. (CVE-2013-4315) It was discovered that the Django is_safe_url utility function did not restrict redirects to certain schemes. An attacker could possibly use this issue to perform a cross-site scripting attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python-django 1.4.5-1ubuntu0.1 Ubuntu 12.10: python-django 1.4.1-2ubuntu0.4 Ubuntu 12.04 LTS: python-django 1.3.1-4ubuntu1.8 Ubuntu 10.04 LTS: python-django 1.1.1-2ubuntu1.9 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1967-1 CVE-2013-1443, CVE-2013-4315 Package Information: https://launchpad.net/ubuntu/+source/python-django/1.4.5-1ubuntu0.1 https://launchpad.net/ubuntu/+source/python-django/1.4.1-2ubuntu0.4 https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.8 https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.9 . Django security issues resolved in Ubuntu1967-1 notice, featuring essential patches and safety considerations.. Ubuntu Security Notice, Django Updates, Security Patches. . Severity: Critical. LinuxSecurity.com Team

Sep 24, 2013 •Critical Ubuntu