MGASA-2015-0026

Dashboard / Vulnerabilities / MGASA-2015-0026

MGASA-2015-0026

Summary: Updated python-django and python-django14 packages fix security vulnerabilities

Details: Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219). Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220). Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221). Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).

References: https://advisories.mageia.org/MGASA-2015-0026.html, https://bugs.mageia.org/show_bug.cgi?id=15045, https://www.djangoproject.com/weblog/2015/jan/13/security/, http://www.ubuntu.com/usn/usn-2469-1/