[Full-disclosure] [USN-1066-1] Django vulnerabilities

[Jamie Strandboge <jamie@xxxxxxxxxxxxx>]

===========================================================
Ubuntu Security Notice USN-1066-1         February 17, 2011
python-django vulnerabilities
CVE-2011-0696, CVE-2011-0697
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  python-django                   1.1.1-1ubuntu1.2

Ubuntu 10.04 LTS:
  python-django                   1.1.1-2ubuntu1.3

Ubuntu 10.10:
  python-django                   1.2.3-1ubuntu0.2.10.10.2

ATTENTION: This update introduces a small backwards-imcompatible change
to perform full CSRF validation on all requests. Prior to this update,
AJAX requests were excepted from CSRF protections. For more details, please
see http://docs.djangoproject.com/en/1.2/releases/1.2.5/.

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that Django did not properly validate HTTP requests that
contain an X-Requested-With header. An attacker could exploit this
vulnerability to perform cross-site request forgery (CSRF) attacks.
(CVE-2011-0696)

It was discovered that Django did not properly sanitize its input when
performing file uploads, resulting in cross-site scripting (XSS)
vulnerabilities. With cross-site scripting vulnerabilities, if a user were
tricked into viewing server output during a crafted server request, a
remote attacker could exploit this to modify the contents, or steal
confidential data, within the same domain. (CVE-2011-0697)


Updated packages for Ubuntu 9.10:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-1ubuntu1.2.diff.gz
      Size/MD5:    23178 9ee3275d17444e0fe9f29b558a50d656
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-1ubuntu1.2.dsc
      Size/MD5:     2215 9665d3d7efb78757cc7debdd8de52dee
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1.orig.tar.gz
      Size/MD5:  5614106 d7839c192e115f9c4dd8777de24dc21c

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django-doc_1.1.1-1ubuntu1.2_all.deb
      Size/MD5:  1538754 55ff7dfcdb230ee959fab143168fee3d
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-1ubuntu1.2_all.deb
      Size/MD5:  3905196 27510c2c2b922666858a4e9153edf0bb

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-2ubuntu1.3.diff.gz
      Size/MD5:    46514 cdf31c55963b3a900c532a56ad14ba54
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-2ubuntu1.3.dsc
      Size/MD5:     2215 4de71582b629ed7c3fe5c3334e1d98aa
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1.orig.tar.gz
      Size/MD5:  5614106 d7839c192e115f9c4dd8777de24dc21c

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django-doc_1.1.1-2ubuntu1.3_all.deb
      Size/MD5:  1538984 ed92fc05b0b71d3adc04b67424198a90
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.1.1-2ubuntu1.3_all.deb
      Size/MD5:  3882040 13e2019e1fa464992f8c68bbc52f4e36

Updated packages for Ubuntu 10.10:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.2.3-1ubuntu0.2.10.10.2.debian.tar.gz
      Size/MD5:    27750 df339fbad6cc5389fc4979ea9ef89455
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.2.3-1ubuntu0.2.10.10.2.dsc
      Size/MD5:     2276 6dba452984483a7442de365e451f1fde
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.2.3.orig.tar.gz
      Size/MD5:  6306760 10bfb5831bcb4d3b1e6298d0e41d6603

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django-doc_1.2.3-1ubuntu0.2.10.10.2_all.deb
      Size/MD5:  1895718 bb292031a0bf07b951aea19bf8648e84
    
http://security.ubuntu.com/ubuntu/pool/main/p/python-django/python-django_1.2.3-1ubuntu0.2.10.10.2_all.deb
      Size/MD5:  4176780 44a6a1e51fc90fd3054ef09a3a2294c8

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/