Advisories ยป MGASA-2015-0026

Updated python-django and python-django14 packages fix security vulnerabilities

Publication date: 17 Jan 2015
Modification date: 17 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-0219 , CVE-2015-0220 , CVE-2015-0221 , CVE-2015-0222

Description

Jedediah Smith discovered that Django incorrectly handled underscores in
WSGI headers. A remote attacker could possibly use this issue to spoof
headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied
redirect URLs. A remote attacker could possibly use this issue to perform a
cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in
django.views.static.serve(). A remote attacker could possibly use this
issue to cause Django to consume resources, resulting in a denial of
service (CVE-2015-0221).

Keryn Knight discovered that Django incorrectly handled forms with
ModelMultipleChoiceField. A remote attacker could possibly use this issue
to cause a large number of SQL queries, resulting in a database denial of
service. Note that this issue only affected python-django (CVE-2015-0222).

References

SRPMS

4/core