CVE-2015-2241

Related Files

Mandriva Linux Security Advisory 2015-109

Posted Mar 30, 2015

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2015-109 - Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments. Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack. Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service. Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django. Cross-site scripting vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a \@property.

tags | advisory, remote, web, denial of service, arbitrary, spoof, xss, python

systems | linux, mandriva

advisories | CVE-2015-0219, CVE-2015-0220, CVE-2015-0221, CVE-2015-0222, CVE-2015-2241

SHA-256 | 73ed54e1b87bdc65f660a901fe9524ca68b38f6616915656e7bcdd6f60701f1c

Download | Favorite | View