Mageia alert MGASA-2013-0283 (python-django)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0283: Updated python-django package fixes security vulnerability 
Date:
    	     
 
Thu, 19 Sep 2013 11:41:45 +0200
Message-ID:
    	     
 
<20130919094145.354B75B0AE@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0283 - Updated python-django package fixes security vulnerability

Publication date: 19 Sep 2013
URL: http://advisories.mageia.org/MGASA-2013-0283.html
Type: security
Affected Mageia releases: 2
CVE: CVE-2013-4315

Description:
Rainer Koirikivi discovered a directory traversal vulnerability with
'ssi' template tags in python-django, a high-level Python web development
framework. It was shown that the handling of the 'ALLOWED_INCLUDE_ROOTS'
setting, used to represent allowed prefixes for the {% ssi %} template
tag, is vulnerable to a directory traversal attack, by specifying a file
path which begins as the absolute path of a directory in
'ALLOWED_INCLUDE_ROOTS', and then uses relative paths to break free. To
exploit this vulnerability an attacker must be in a position to alter
templates on the site, or the site to be attacked must have one or more
templates making use of the 'ssi' tag, and must allow some form of
unsanitized user input to be used as an argument to the 'ssi' tag
(CVE-2013-4315).

References:
- https://bugs.mageia.org/show_bug.cgi?id=11217
- https://www.djangoproject.com/weblog/2013/sep/10/security...
- http://www.debian.org/security/2013/dsa-2755
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4315

SRPMS:
- 2/core/python-django-1.3.7-1.2.mga2