1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 2529-1] python-django security update

    From Thijs Kinkhorst@1:229/2 to All on Tue Aug 14 22:20:02 2012
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2529-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 14, 2012 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : python-django
    Vulnerability : several
    Problem type : remote
    Debian-specific: no
    CVE ID : CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
    Debian Bug : 683364

    Jeroen Dekkers and others reported several vulnerabilities in Django,
    a Python Web framework. The Common Vulnerabilities and Exposures
    project defines the following issues:

    CVE-2012-3442

    Two functions do not validate the scheme of a redirect target,
    which might allow remote attackers to conduct cross-site scripting
    (XSS) attacks via a data: URL.

    CVE-2012-3443

    The ImageField class completely decompresses image data during image
    validation, which allows remote attackers to cause a denial of service
    (memory consumption) by uploading an image file.

    CVE-2012-3444

    The get_image_dimensions function in the image-handling functionality
    uses a constant chunk size in all attempts to determine dimensions,
    which allows remote attackers to cause a denial of service (process
    or thread consumption) via a large TIFF image.

    For the stable distribution (squeeze), this problem has been fixed in
    version 1.2.3-3+squeeze3.

    For the unstable distribution (sid), this problem has been fixed in
    version 1.4.1-1.

    We recommend that you upgrade your python-django packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.12 (GNU/Linux)

    iQEcBAEBAgAGBQJQKq3KAAoJEFb2GnlAHawE8hMIAKNQuSMjICwTzposnEnW7zVm I5gDaLDI8Yu3xGrnqnI8n0uPug2NpjyIVMb408oupfSsaBKmnYkYJgVgy3VpRu1Z L8a45HdjOkDZEgDTYJIUM/jMp0coRcHj8oLLxYczl9ImTXqJC/OlSb51iqrspiZf aFaG1Ct2TLZb+Lp3IEv6JJMhknRsGSqS1Tk9ewvnueuxgkw+prWtpWM6PclzmZxu 0INZlMQ9jIYBS5BKzfi47taaKcrEZ1xiBBupPwFjghJEZDMcRLTFCvptzMgIDfle Eu31UGxkbrqkLpVUBY8wgmvlrQGhW05nkQKmojfvf6EU/95SAEC8TkbndWSt5i0=
    =Nscn
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Neha Chriss@1:229/2 to Thijs Kinkhorst on Tue Aug 14 22:40:02 2012
    XPost: linux.debian.security
    From: [email protected]

    ..and here we go again. I will patch on salesforce yms..

    On Tue, Aug 14, 2012 at 1:05 PM, Thijs Kinkhorst <[email protected]> wrote:
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2529-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 14, 2012 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : python-django
    Vulnerability : several
    Problem type : remote
    Debian-specific: no
    CVE ID : CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
    Debian Bug : 683364

    Jeroen Dekkers and others reported several vulnerabilities in Django,
    a Python Web framework. The Common Vulnerabilities and Exposures
    project defines the following issues:

    CVE-2012-3442

    Two functions do not validate the scheme of a redirect target,
    which might allow remote attackers to conduct cross-site scripting
    (XSS) attacks via a data: URL.

    CVE-2012-3443

    The ImageField class completely decompresses image data during image
    validation, which allows remote attackers to cause a denial of service
    (memory consumption) by uploading an image file.

    CVE-2012-3444

    The get_image_dimensions function in the image-handling functionality
    uses a constant chunk size in all attempts to determine dimensions,
    which allows remote attackers to cause a denial of service (process
    or thread consumption) via a large TIFF image.

    For the stable distribution (squeeze), this problem has been fixed in
    version 1.2.3-3+squeeze3.

    For the unstable distribution (sid), this problem has been fixed in
    version 1.4.1-1.

    We recommend that you upgrade your python-django packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.12 (GNU/Linux)

    iQEcBAEBAgAGBQJQKq3KAAoJEFb2GnlAHawE8hMIAKNQuSMjICwTzposnEnW7zVm I5gDaLDI8Yu3xGrnqnI8n0uPug2NpjyIVMb408oupfSsaBKmnYkYJgVgy3VpRu1Z L8a45HdjOkDZEgDTYJIUM/jMp0coRcHj8oLLxYczl9ImTXqJC/OlSb51iqrspiZf aFaG1Ct2TLZb+Lp3IEv6JJMhknRsGSqS1Tk9ewvnueuxgkw+prWtpWM6PclzmZxu 0INZlMQ9jIYBS5BKzfi47taaKcrEZ1xiBBupPwFjghJEZDMcRLTFCvptzMgIDfle Eu31UGxkbrqkLpVUBY8wgmvlrQGhW05nkQKmojfvf6EU/95SAEC8TkbndWSt5i0=
    =Nscn
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]



    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/CALbdXZ3JFNBV2KUPimaa+PihnUKce6V2XMdnRDOkqKnQcAfy-Q@mail.gmail.com

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)