python-django: two vulnerabilities
| Package(s): | python-django | CVE #(s): | CVE-2016-2512 CVE-2016-2513 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 2, 2016 | Updated: | April 8, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512) Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513) | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||