[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 17 Dec 2012 11:22:33 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Django 1.3.5, Django 1.4.3, and Django 1.5 beta 2 Security Update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So a week ago Django released 1.3.5, Django 1.4.3, and Django 1.5 beta
2 as a security update. I have not assigned these a CVE since they
appear to be security hardening, and not addressing a direct security
threat (but I could be wrong so I'm posting this).
Change #1: Host header poisoning
This implements white list filtering, which is almost always better
than black list filtering:
Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or
dot ('.').
IP addresses -- both IPv4 and IPv6 -- are permitted.
Port, if specified, is numeric.
Change #2: Redirect poisoning
They added a new function "django.utils.http.is_safe_url" and added it
to the spots within Django's code that would benefit from it.
A new utility function, django.utils.http.is_safe_url, is added; this
function takes a URL and a hostname, and checks that the URL is either
relative, or if absolute matches the supplied hostname.
All of Django's own built-in views -- primarily in the authentication
system -- which allow user-supplied redirect targets now use
is_safe_url to validate the supplied URL.
Over all these are very good changes, but they are not security fixes
per se as stated above, however if anyone is aware of
attacks/vulnerabilities pertaining to these changes please let me know
and I iwll assign CVEs.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQz2LpAAoJEBYNRVNeJnmTBDIP/1mgINGVaWHQb60tMB04c6Ik
s4Ir+47Idtdzz+FI0bk84D5lGOhGuAq2NGXZaJHNAwH+A6JSasjgsUX4ynW/ReGN
fHldldsYAsfb0m0F7DDJqwrgaAfdP7OdNpFbqc6OZ/VLbgEDh0cdF2jkkRJzML5w
gJIYwGp+XU4lEwC5Fy9eZzCmNkWZBkzwfWCRGx7vPTdsgehQvzpeQ89+r6IEHknj
w+JZY5cA0hlL8xCC05LSIGb7ew95hBY3seSVL9aUvTGvVn3Ek8L4tVm/angHYJaD
XghGJTgMxtiYthf1uahBwPScBWeiRcTwdFeFliPzvyb7PuAOrLsqBMgSv2uRvExM
i9pPHXAOri5sDFtakzlQRWC9FAWxk52dwXiTcMDYDPRW50TLWbPfWfOWjggGiJYJ
2+u80598X4CI7lF0hmVJ1EDbki1JufUDaJlkMKpCxbjEA+txT0wXa+mxGERkHfvk
rPSo66wZIK3W7rDjb18H4wll3pW0blp5lI583pXaCmUjl7YjtMNB3XvxwIsAC/SC
u/vHe17BxuG+hUgt7NCUuGUrqtB7sEUVlOuOKfRyVzN9ZE98WfegTCzlOApphz3V
GFitZxQDqr8n2iXw+soITpH0SAhuHkohrimnzK01xO/wXrX4kg/2KyexlN5IBOCo
oSUzUhaTLx1TgkcxSBwQ
=ZHlN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
