SUSE-SU-2018:0973-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:0973-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2018:0973-1
- Related
- Published
- 2018-04-18T06:31:23Z
- Modified
- 2018-04-18T06:31:23Z
- Summary
- Security update for python-Django
- Details
-
This update for python-Django fixes the following issues:
Security issues fixed:
- CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
- CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
- CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
- CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
- CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
- CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
- CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
- CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
- References
-
- https://www.suse.com/support/update/announcement/2018/suse-su-20180973-1/
- https://bugzilla.suse.com/1001374
- https://bugzilla.suse.com/1008047
- https://bugzilla.suse.com/1008050
- https://bugzilla.suse.com/1031450
- https://bugzilla.suse.com/1031451
- https://bugzilla.suse.com/1056284
- https://bugzilla.suse.com/1083304
- https://bugzilla.suse.com/1083305
- https://www.suse.com/security/cve/CVE-2016-7401
- https://www.suse.com/security/cve/CVE-2016-9013
- https://www.suse.com/security/cve/CVE-2016-9014
- https://www.suse.com/security/cve/CVE-2017-12794
- https://www.suse.com/security/cve/CVE-2017-7233
- https://www.suse.com/security/cve/CVE-2017-7234
- https://www.suse.com/security/cve/CVE-2018-7536
- https://www.suse.com/security/cve/CVE-2018-7537