Home page logo
/

oss-sec logo oss-sec mailing list archives

Django 1.3.5, Django 1.4.3, and Django 1.5 beta 2 Security Update
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 17 Dec 2012 11:22:33 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So a week ago Django released 1.3.5, Django 1.4.3, and Django 1.5 beta
2 as a security update. I have not assigned these a CVE since they
appear to be security hardening, and not addressing a direct security
threat (but I could be wrong so I'm posting this).

Change #1: Host header poisoning

This implements white list filtering, which is almost always better
than black list filtering:

Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or
dot ('.').
IP addresses -- both IPv4 and IPv6 -- are permitted.
Port, if specified, is numeric.

Change #2: Redirect poisoning

They added a new function "django.utils.http.is_safe_url" and added it
to the spots within Django's code that would benefit from it.

A new utility function, django.utils.http.is_safe_url, is added; this
function takes a URL and a hostname, and checks that the URL is either
relative, or if absolute matches the supplied hostname.
All of Django's own built-in views -- primarily in the authentication
system -- which allow user-supplied redirect targets now use
is_safe_url to validate the supplied URL.

Over all these are very good changes, but they are not security fixes
per se as stated above, however if anyone is aware of
attacks/vulnerabilities pertaining to these changes please let me know
and I iwll assign CVEs.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQz2LpAAoJEBYNRVNeJnmTBDIP/1mgINGVaWHQb60tMB04c6Ik
s4Ir+47Idtdzz+FI0bk84D5lGOhGuAq2NGXZaJHNAwH+A6JSasjgsUX4ynW/ReGN
fHldldsYAsfb0m0F7DDJqwrgaAfdP7OdNpFbqc6OZ/VLbgEDh0cdF2jkkRJzML5w
gJIYwGp+XU4lEwC5Fy9eZzCmNkWZBkzwfWCRGx7vPTdsgehQvzpeQ89+r6IEHknj
w+JZY5cA0hlL8xCC05LSIGb7ew95hBY3seSVL9aUvTGvVn3Ek8L4tVm/angHYJaD
XghGJTgMxtiYthf1uahBwPScBWeiRcTwdFeFliPzvyb7PuAOrLsqBMgSv2uRvExM
i9pPHXAOri5sDFtakzlQRWC9FAWxk52dwXiTcMDYDPRW50TLWbPfWfOWjggGiJYJ
2+u80598X4CI7lF0hmVJ1EDbki1JufUDaJlkMKpCxbjEA+txT0wXa+mxGERkHfvk
rPSo66wZIK3W7rDjb18H4wll3pW0blp5lI583pXaCmUjl7YjtMNB3XvxwIsAC/SC
u/vHe17BxuG+hUgt7NCUuGUrqtB7sEUVlOuOKfRyVzN9ZE98WfegTCzlOApphz3V
GFitZxQDqr8n2iXw+soITpH0SAhuHkohrimnzK01xO/wXrX4kg/2KyexlN5IBOCo
oSUzUhaTLx1TgkcxSBwQ
=ZHlN
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
  • Django 1.3.5, Django 1.4.3, and Django 1.5 beta 2 Security Update Kurt Seifried (Dec 17)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault