| |||||||||||||||||||
Ubuntu alert USN-1967-1 (python-django)
========================================================================== Ubuntu Security Notice USN-1967-1 September 24, 2013 python-django vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in Django. Software Description: - python-django: High-level Python web development framework Details: It was discovered that Django incorrectly handled large passwords. A remote attacker could use this issue to consume resources, resulting in a denial of service. (CVE-2013-1443) It was discovered that Django incorrectly handled ssi templates. An attacker could use this issue to read arbitrary files. (CVE-2013-4315) It was discovered that the Django is_safe_url utility function did not restrict redirects to certain schemes. An attacker could possibly use this issue to perform a cross-site scripting attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: python-django 1.4.5-1ubuntu0.1 Ubuntu 12.10: python-django 1.4.1-2ubuntu0.4 Ubuntu 12.04 LTS: python-django 1.3.1-4ubuntu1.8 Ubuntu 10.04 LTS: python-django 1.1.1-2ubuntu1.9 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1967-1 CVE-2013-1443, CVE-2013-4315 Package Information: https://launchpad.net/ubuntu/+source/python-django/1.4.5-... https://launchpad.net/ubuntu/+source/python-django/1.4.1-... https://launchpad.net/ubuntu/+source/python-django/1.3.1-... https://launchpad.net/ubuntu/+source/python-django/1.1.1-... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security... (Log in to post comments)
|
|||||||||||||||||||