drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Django
Name: |
Mehrere Probleme in Django |
|
ID: |
USN-2347-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 14.04 LTS |
|
Datum: |
Di, 16. September 2014, 18:46 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483 |
|
Applikationen: |
Django |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============1830086768486816135== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Bwu7i8PSwBh8UrlEIVHlXPbrbMx9HIQRW"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Bwu7i8PSwBh8UrlEIVHlXPbrbMx9HIQRW Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2347-1 September 16, 2014
python-django vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Django.
Software Description: - python-django: High-level Python web development framework
Details:
Florian Apolloner discovered that Django incorrectly validated URLs. A remote attacker could use this issue to conduct phishing attacks. (CVE-2014-0480)
David Wilson discovered that Django incorrectly handled file name generation. A remote attacker could use this issue to cause Django to consume resources, resulting in a denial of service. (CVE-2014-0481)
David Greisen discovered that Django incorrectly handled certain headers in contrib.auth.middleware.RemoteUserMiddleware. A remote authenticated user could use this issue to hijack web sessions. (CVE-2014-0482)
Collin Anderson discovered that Django incorrectly checked if a field represented a relationship between models in the administrative interface. A remote authenticated user could use this issue to possibly obtain sensitive information. (CVE-2014-0483)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04 LTS: python-django 1.6.1-2ubuntu0.4
Ubuntu 12.04 LTS: python-django 1.3.1-4ubuntu1.12
Ubuntu 10.04 LTS: python-django 1.1.1-2ubuntu1.13
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2347-1 CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483
Package Information: https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.4 https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.12 https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.13
--Bwu7i8PSwBh8UrlEIVHlXPbrbMx9HIQRW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIcBAEBCgAGBQJUGCoBAAoJEGVp2FWnRL6T6jcP/iWO9hTy5CwpHZBTwIXQ1b99 fExDT9jGFPfr62u1Rln5HQVO2dl6KOnzcXym44sCGyF6krejnWEBh+7QjIi/g2GV t1Qa802Vd/+J6tAqYJX7aiaQXMegQCK5HGOMAnHbbmT6zlghLPPwNpjvmKl8C2ep Y8lfpkFj49zL3Bd31lzZFLk/96XR4BPIRRpwybtBIgQCz7hbTMr8FkwB0nUt3Ir6 MKYnBW8W088l9lSOPTurO5BH+Cqy7SWhEHdN7/DOcUm1rU8PGI67jnITOpcPylEQ 7C7BAJsWhmjhfXdoYwJS5pw+RmZAmhgixZHA72UeIPXLHLyy4nrmpM3wJfxr6/We WE6KYVV9TRpOa9htsHFGCPCRKu/EIuH7IA/lYmPEn6hHk8ptwN0tp1kSyB9b7e7t vs0cQyyjNLT9R9ylRNRqhWpIDo6ZSmzFwachjOyXYkkYO3P730Tpz79yi+CVgtUU zxx6Nt4KUS29rggqe54wl6fwfhnoZ2+CtKQ3SZKEk9/ZxzSRUd9mQQ3j2kRRBe69 09iihItG8y8Bvgd9h/BW0lUQBv1Wd03GmTsA1dJm5Y/y1hSRtQ4E14IR/yDZU4Ym ObczEMi15M/YocdksLOJzecvE6DzLkV3PwhwSxpgd82pjAsbX7y82kTgrxlxL/jY 9SIRrwevd21NeTgiG3j+ =utdh -----END PGP SIGNATURE-----
--Bwu7i8PSwBh8UrlEIVHlXPbrbMx9HIQRW--
--===============1830086768486816135== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============1830086768486816135==--
|
|
|
|