Date: Mon, 17 Dec 2012 11:22:33 -0700 From: Kurt Seifried <kseifried@...hat.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Django 1.3.5, Django 1.4.3, and Django 1.5 beta 2 Security Update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So a week ago Django released 1.3.5, Django 1.4.3, and Django 1.5 beta 2 as a security update. I have not assigned these a CVE since they appear to be security hardening, and not addressing a direct security threat (but I could be wrong so I'm posting this). Change #1: Host header poisoning This implements white list filtering, which is almost always better than black list filtering: Hostnames must consist of characters [A-Za-z0-9] plus hyphen ('-') or dot ('.'). IP addresses -- both IPv4 and IPv6 -- are permitted. Port, if specified, is numeric. Change #2: Redirect poisoning They added a new function "django.utils.http.is_safe_url" and added it to the spots within Django's code that would benefit from it. A new utility function, django.utils.http.is_safe_url, is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL. Over all these are very good changes, but they are not security fixes per se as stated above, however if anyone is aware of attacks/vulnerabilities pertaining to these changes please let me know and I iwll assign CVEs. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQz2LpAAoJEBYNRVNeJnmTBDIP/1mgINGVaWHQb60tMB04c6Ik s4Ir+47Idtdzz+FI0bk84D5lGOhGuAq2NGXZaJHNAwH+A6JSasjgsUX4ynW/ReGN fHldldsYAsfb0m0F7DDJqwrgaAfdP7OdNpFbqc6OZ/VLbgEDh0cdF2jkkRJzML5w gJIYwGp+XU4lEwC5Fy9eZzCmNkWZBkzwfWCRGx7vPTdsgehQvzpeQ89+r6IEHknj w+JZY5cA0hlL8xCC05LSIGb7ew95hBY3seSVL9aUvTGvVn3Ek8L4tVm/angHYJaD XghGJTgMxtiYthf1uahBwPScBWeiRcTwdFeFliPzvyb7PuAOrLsqBMgSv2uRvExM i9pPHXAOri5sDFtakzlQRWC9FAWxk52dwXiTcMDYDPRW50TLWbPfWfOWjggGiJYJ 2+u80598X4CI7lF0hmVJ1EDbki1JufUDaJlkMKpCxbjEA+txT0wXa+mxGERkHfvk rPSo66wZIK3W7rDjb18H4wll3pW0blp5lI583pXaCmUjl7YjtMNB3XvxwIsAC/SC u/vHe17BxuG+hUgt7NCUuGUrqtB7sEUVlOuOKfRyVzN9ZE98WfegTCzlOApphz3V GFitZxQDqr8n2iXw+soITpH0SAhuHkohrimnzK01xO/wXrX4kg/2KyexlN5IBOCo oSUzUhaTLx1TgkcxSBwQ =ZHlN -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.