USN-2915-2
USN-2915-2 · python-django regression
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
USN-2915-1 fixed vulnerabilities in Django. The upstream fix for CVE-2016-2512 introduced a regression for certain applications. This update fixes the problem by applying the complete upstream regression fix. Original advisory details: Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512) Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513)
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
python-django Ubuntu:14.04:LTS
- Versions du logiciel
- 1.5.4-1ubuntu1
- 1.6-1
- 1.6.1-1
- 1.6.1-2
- 1.6.1-2ubuntu0.1
- 1.6.1-2ubuntu0.2
- 1.6.1-2ubuntu0.3
- 1.6.1-2ubuntu0.4
- 1.6.1-2ubuntu0.5
- 1.6.1-2ubuntu0.6
- 1.6.1-2ubuntu0.8
- 1.6.1-2ubuntu0.9
- 1.6.1-2ubuntu0.10
- 1.6.1-2ubuntu0.11
- 1.6.1-2ubuntu0.12
- 1.6.1-2ubuntu0.13
- Plages de versions concernées
- ECOSYSTEM: < 1.6.1-2ubuntu0.14
Mettez à jour vers 1.6.1-2ubuntu0.14