SUSE-SU-2015:1109-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2015:1109-1

Related

Published

2015-03-30T09:04:33Z

Modified

2015-03-30T09:04:33Z

Summary

Security update for python-Django

Details

python-django was updated to 1.6.11 to fix security issues and non-security bugs.

The following vulnerabilities were fixed:

Made issafeurl() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)
Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)
WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)
Mitigated possible XSS attack via user-supplied redirect URLs
Denial-of-service attack against django.views.static.serve (bnc#913056, CVE-2015-0221)
Database denial-of-service with ModelMultipleChoiceField (bnc#913055, CVE-2015-0222)

The update also contains fixes for non-security bugs, functional and stability issues.

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.11-4.1

{
    "binaries": [
        {
            "python-Django": "1.6.11-4.1"
        }
    ]
}