Django 1.3/1.4 拒绝服务和信息泄露漏洞

BUGTRAQ ID: 58061 CVECAN ID: CVE-2013-0305,CVE-2013-0306 Django是Python编程语言驱动的一个开源Web应用程序框架。 Django 1.3.6、1.4.4之前版本在实现上存在多个漏洞，可被恶意用户利用绕过某些安全限制并造成拒绝服务。 1、扩展XML实体时存在错误，通过包含恶意属性的特制XML，可消耗大量内存。 2、处理某些XML数据时存在错误，通过包含外部实体引用的特制XML数据，可泄露敏感信息。 3、在访问历史视图时，管理员界面没有正确验证访问权限，可被利用查看管理界面内的对象访问历史。...

django -- multiple vulnerabilities

The Django Project reports: These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities. Host header poisoning an attacker could cause Django to generate and display URLs that link to...

CVE-2013-0305

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information...

CVE-2013-0306

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service memory consumption or trigger server errors via a modified maxnum parameter...

CVE-2013-1665

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External...

django CMS 'page_attribute' Template HTML 注入漏洞

BUGTRAQ ID: 57559 django CMS是用pony作为技术支持的CMS，可以前端编辑。 django CMS 2.3.5 之前版本的pageattribute模板标签没有正确过滤，在实现上存在HTML注入漏洞，成功利用后可允许在受影响浏览器中执行HTML和脚本代码。 0 django CMS 2.x 厂商补丁： django CMS ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载2.3.5版本： https://www.django-cms.org/en/...

FreeBSD : django-cms -- XSS Vulnerability (3886cafe-668c-11e2-94b8-1c4bd681f0cf)

Cross-site scripting XSS vulnerability Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the pageattribute template tag. Only users with admin access and the permission to edit at least one django CMS page objec...

Fedora 18 : python-django-1.4.3-1.fc18 (2012-20179)

https://www.djangoproject.com/weblog/2012/dec/10/security/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

FreeBSD : django -- multiple vulnerabilities (1b769b72-582b-11e2-b66b-00e0814cab4e)

The Django Project reports : - Host header poisoning Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains. In response to further input received and reports of continui...

Fedora Update for Django FEDORA-2012-20224

Check for the Version of Django OpenVAS Vulnerability Test Fedora Update for Django FEDORA-2012-20224 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Mandriva Update for python-django MDVSA-2012:181 (python-django)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for Django FEDORA-2012-20224

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 17 Update: Django-1.4.3-1.fc17

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora 17 : Django-1.4.3-1.fc17 (2012-20224)

https://www.djangoproject.com/weblog/2012/dec/10/security/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Mandriva Linux Security Advisory : python-django (MDVSA-2012:181)

Multiple host header poisoning flaws were found and fixed in Django. The updated packages have been upgraded to the 1.3.5 version which is not affected by these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

django -- multiple vulnerabilities

The Django Project reports: Host header poisoning Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains. In response to further input received and reports of continuing...

django-cms -- XSS Vulnerability

Cross-site scripting XSS vulnerability Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the pageattribute template tag. Only users with admin access and the permission to edit at least one django CMS page objec...

Fedora 18 : python-django-horizon-2012.2-4.fc18 (2012-18185)

drop python-cloudfiles as requirement - fix CVE-2012-5474 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 18 Update: python-django-horizon-2012.2-4.fc18

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...

Ubuntu Update for python-django USN-1632-2

Ubuntu Update for Linux kernel vulnerabilities USN-1632-2 OpenVAS Vulnerability Test $Id: gbubuntuUSN16322.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-django USN-1632-2 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.ne...