SUSE-SU-2018:1102-1

Dashboard / Vulnerabilities / SUSE-SU-2018:1102-1

SUSE-SU-2018:1102-1

Summary: Security update for python-Django

Details: This update for python-Django fixes the following issues: Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304) - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284) - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451) - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450) - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047) - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050) - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374) - CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary web site and conduct phishing attacks. (bsc#bnc#967999)

References: https://www.suse.com/support/update/announcement/2018/suse-su-20181102-1/, https://bugzilla.suse.com/1001374, https://bugzilla.suse.com/1008047, https://bugzilla.suse.com/1008050, https://bugzilla.suse.com/1031450, https://bugzilla.suse.com/1031451, https://bugzilla.suse.com/1056284, https://bugzilla.suse.com/1083304, https://bugzilla.suse.com/1083305, https://bugzilla.suse.com/967999, https://www.suse.com/security/cve/CVE-2016-2512, https://www.suse.com/security/cve/CVE-2016-7401, https://www.suse.com/security/cve/CVE-2016-9013, https://www.suse.com/security/cve/CVE-2016-9014, https://www.suse.com/security/cve/CVE-2017-12794, https://www.suse.com/security/cve/CVE-2017-7233, https://www.suse.com/security/cve/CVE-2017-7234, https://www.suse.com/security/cve/CVE-2018-7536, https://www.suse.com/security/cve/CVE-2018-7537