Startseite ▼ Bookkeeping
Online ▼ Sicherheits
Überprüfungs ▼
Verwaltetes
DNS ▼
Info
Bestellen/Erneuern
FAQ
AUP
Dynamic DNS Clients
Domaine konfigurieren Dyanmic DNS Update Password Netzwerk
Überwachung ▼
Enterprise
Erweiterte
Standard
Gratis Test
FAQ
Preis/Funktionszusammenfassung
Bestellen
Beispiele
Konfigurieren/Status Alarm Profile | |||
Test Kennung: | 1.3.6.1.4.1.25623.1.0.703010 |
Kategorie: | Debian Local Security Checks |
Titel: | Debian Security Advisory DSA 3010-1 (python-django - security update) |
Zusammenfassung: | Several vulnerabilities were discovered in Django, a high-level Python;web development framework. The Common Vulnerabilities and Exposures;project identifies the following problems:;;CVE-2014-0480;Florian Apolloner discovered that in certain situations, URL;reversing could generate scheme-relative URLs which could;unexpectedly redirect a user to a different host, leading to;phishing attacks.;;CVE-2014-0481;David Wilson reported a file upload denial of service vulnerability.;Django's file upload handling in its default configuration may;degrade to producing a huge number of `os.stat()` system calls when;a duplicate filename is uploaded. A remote attacker with the ability;to upload files can cause poor performance in the upload handler,;eventually causing it to become very slow.;;CVE-2014-0482;David Greisen discovered that under some circumstances, the use of;the RemoteUserMiddleware middleware and the RemoteUserBackend;authentication backend could result in one user receiving another;user's session, if a change to the REMOTE_USER header occurred;without corresponding logout/login actions.;;CVE-2014-0483Collin Anderson discovered that it is possible to reveal any field's;data by modifying the popup and to_field;parameters of the query;string on an admin change form page. A user with access to the admin;interface, and with sufficient knowledge of model structure and the;appropriate URLs, could construct popup views which would display;the values of non-relationship fields, including fields the;application developer had not intended to expose in such a fashion. |
Beschreibung: | Summary: Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0480 Florian Apolloner discovered that in certain situations, URL reversing could generate scheme-relative URLs which could unexpectedly redirect a user to a different host, leading to phishing attacks. CVE-2014-0481 David Wilson reported a file upload denial of service vulnerability. Django's file upload handling in its default configuration may degrade to producing a huge number of `os.stat()` system calls when a duplicate filename is uploaded. A remote attacker with the ability to upload files can cause poor performance in the upload handler, eventually causing it to become very slow. CVE-2014-0482 David Greisen discovered that under some circumstances, the use of the RemoteUserMiddleware middleware and the RemoteUserBackend authentication backend could result in one user receiving another user's session, if a change to the REMOTE_USER header occurred without corresponding logout/login actions. CVE-2014-0483Collin Anderson discovered that it is possible to reveal any field's data by modifying the popup and to_field parameters of the query string on an admin change form page. A user with access to the admin interface, and with sufficient knowledge of model structure and the appropriate URLs, could construct popup views which would display the values of non-relationship fields, including fields the application developer had not intended to expose in such a fashion. Affected Software/OS: python-django on Debian Linux Solution: For the stable distribution (wheezy), these problems have been fixed in version 1.4.5-1+deb7u8. For the unstable distribution (sid), these problems have been fixed in version 1.6.6-1. We recommend that you upgrade your python-django packages. CVSS Score: 6.0 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P |
Querverweis: |
Common Vulnerability Exposure (CVE) ID: CVE-2014-0480 BugTraq ID: 69425 http://www.securityfocus.com/bid/69425 Debian Security Information: DSA-3010 (Google Search) http://www.debian.org/security/2014/dsa-3010 http://secunia.com/advisories/59782 http://secunia.com/advisories/61276 http://secunia.com/advisories/61281 SuSE Security Announcement: openSUSE-SU-2014:1132 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0481 Common Vulnerability Exposure (CVE) ID: CVE-2014-0482 Common Vulnerability Exposure (CVE) ID: CVE-2014-0483 |
Copyright | Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net |
Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten. |