openSUSE Security Update: Security update for python-Django ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0643-1 Rating: moderate References: #913053 #913055 #913056 #923172 #923176 Cross-References: CVE-2015-0219 CVE-2015-0221 CVE-2015-0222 CVE-2015-2316 CVE-2015-2317 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: python-django was updated to 1.6.11 to fix security issues and non-security bugs. THe following vulnerabilities were fixed: * Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317) * Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316) * WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219) * Mitigated possible XSS attack via user-supplied redirect URLs * Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221) * Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222) The update also contains fixes for non-security bugs, functional and stability issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-281=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (noarch): python-Django-1.6.11-3.4.1 References: https://www.suse.com/security/cve/CVE-2015-0219.html https://www.suse.com/security/cve/CVE-2015-0221.html https://www.suse.com/security/cve/CVE-2015-0222.html https://www.suse.com/security/cve/CVE-2015-2316.html https://www.suse.com/security/cve/CVE-2015-2317.html https://bugzilla.suse.com/913053 https://bugzilla.suse.com/913055 https://bugzilla.suse.com/913056 https://bugzilla.suse.com/923172 https://bugzilla.suse.com/923176