Mailinglist Archive: opensuse-updates (61 mails)
< Previous | Next > |
openSUSE-SU-2015:0643-1: moderate: Security update for python-Django
- From: opensuse-security@xxxxxxxxxxxx
- Date: Wed, 1 Apr 2015 18:04:50 +0200 (CEST)
- Message-id: <20150401160450.75D2832398@maintenance.suse.de>
openSUSE Security Update: Security update for python-Django
______________________________________________________________________________
Announcement ID: openSUSE-SU-2015:0643-1
Rating: moderate
References: #913053 #913055 #913056 #923172 #923176
Cross-References: CVE-2015-0219 CVE-2015-0221 CVE-2015-0222
CVE-2015-2316 CVE-2015-2317
Affected Products:
openSUSE 13.2
______________________________________________________________________________
An update that fixes 5 vulnerabilities is now available.
Description:
python-django was updated to 1.6.11 to fix security issues and
non-security bugs.
THe following vulnerabilities were fixed:
* Made is_safe_url() reject URLs that start with control characters to
mitigate possible XSS attack via user-supplied redirect URLs
(bnc#923176, CVE-2015-2317)
* Fixed an infinite loop possibility in strip_tags() (bnc#923172,
CVE-2015-2316)
* WSGI header spoofing via underscore/dash conflation (bnc#913053,
CVE-2015-0219)
* Mitigated possible XSS attack via user-supplied redirect URLs
* Denial-of-service attack against ``django.views.static.serve``
(bnc#913056, CVE-2015-0221)
* Database denial-of-service with ``ModelMultipleChoiceField``
(bnc#913055, CVE-2015-0222)
The update also contains fixes for non-security bugs, functional and
stability issues.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 13.2:
zypper in -t patch openSUSE-2015-281=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.2 (noarch):
python-Django-1.6.11-3.4.1
References:
https://www.suse.com/security/cve/CVE-2015-0219.html
https://www.suse.com/security/cve/CVE-2015-0221.html
https://www.suse.com/security/cve/CVE-2015-0222.html
https://www.suse.com/security/cve/CVE-2015-2316.html
https://www.suse.com/security/cve/CVE-2015-2317.html
https://bugzilla.suse.com/913053
https://bugzilla.suse.com/913055
https://bugzilla.suse.com/913056
https://bugzilla.suse.com/923172
https://bugzilla.suse.com/923176
______________________________________________________________________________
Announcement ID: openSUSE-SU-2015:0643-1
Rating: moderate
References: #913053 #913055 #913056 #923172 #923176
Cross-References: CVE-2015-0219 CVE-2015-0221 CVE-2015-0222
CVE-2015-2316 CVE-2015-2317
Affected Products:
openSUSE 13.2
______________________________________________________________________________
An update that fixes 5 vulnerabilities is now available.
Description:
python-django was updated to 1.6.11 to fix security issues and
non-security bugs.
THe following vulnerabilities were fixed:
* Made is_safe_url() reject URLs that start with control characters to
mitigate possible XSS attack via user-supplied redirect URLs
(bnc#923176, CVE-2015-2317)
* Fixed an infinite loop possibility in strip_tags() (bnc#923172,
CVE-2015-2316)
* WSGI header spoofing via underscore/dash conflation (bnc#913053,
CVE-2015-0219)
* Mitigated possible XSS attack via user-supplied redirect URLs
* Denial-of-service attack against ``django.views.static.serve``
(bnc#913056, CVE-2015-0221)
* Database denial-of-service with ``ModelMultipleChoiceField``
(bnc#913055, CVE-2015-0222)
The update also contains fixes for non-security bugs, functional and
stability issues.
Patch Instructions:
To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- openSUSE 13.2:
zypper in -t patch openSUSE-2015-281=1
To bring your system up-to-date, use "zypper patch".
Package List:
- openSUSE 13.2 (noarch):
python-Django-1.6.11-3.4.1
References:
https://www.suse.com/security/cve/CVE-2015-0219.html
https://www.suse.com/security/cve/CVE-2015-0221.html
https://www.suse.com/security/cve/CVE-2015-0222.html
https://www.suse.com/security/cve/CVE-2015-2316.html
https://www.suse.com/security/cve/CVE-2015-2317.html
https://bugzilla.suse.com/913053
https://bugzilla.suse.com/913055
https://bugzilla.suse.com/913056
https://bugzilla.suse.com/923172
https://bugzilla.suse.com/923176
< Previous | Next > |