Test Kennung:	1.3.6.1.4.1.25623.1.0.70548
Kategorie:	Debian Local Security Checks
Titel:	Debian Security Advisory DSA 2332-1 (python-django)
Zusammenfassung:	The remote host is missing an update to python-django;announced via advisory DSA 2332-1.
Beschreibung:	Summary: The remote host is missing an update to python-django announced via advisory DSA 2332-1. Vulnerability Insight: Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework: CVE-2011-4136 When using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache. When user data is stored in the same cache, a remote user may take over a session. CVE-2011-4137, CVE-2011-4138 Django's field type URLfield by default checks supplied URL's by issuing a request to it, which doesn't time out. A Denial of Service is possible by supplying specially prepared URL's that keep the connection open indefinitely or fill the Django's server memory. CVE-2011-4139 Django used X-Forwarded-Host headers to construct full URL's. This header may not contain trusted input and could be used to poison the cache. CVE-2011-4140 The CSRF protection mechanism in Django does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests. For the oldstable distribution (lenny), this problem has been fixed in version 1.0.2-1+lenny3. For the stable distribution (squeeze), this problem has been fixed in version 1.2.3-3+squeeze2. For the testing (wheezy) and unstable distribution (sid), this problem has been fixed in version 1.3.1-1. Solution: We recommend that you upgrade your python-django packages. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4136 Debian Security Information: DSA-2332 (Google Search) http://www.debian.org/security/2011/dsa-2332 http://openwall.com/lists/oss-security/2011/09/11/1 http://openwall.com/lists/oss-security/2011/09/13/2 http://secunia.com/advisories/46614 SuSE Security Announcement: openSUSE-SU-2012:0653 (Google Search) https://hermes.opensuse.org/messages/14700881 Common Vulnerability Exposure (CVE) ID: CVE-2011-4137 http://openwall.com/lists/oss-security/2011/09/15/5 Common Vulnerability Exposure (CVE) ID: CVE-2011-4138 Common Vulnerability Exposure (CVE) ID: CVE-2011-4139 Common Vulnerability Exposure (CVE) ID: CVE-2011-4140
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.