USN-2915-3
USN-2915-3 · python-django regression
This page contains facts from public vulnerability sources. Check the original advisory before updating.
USN-2915-1 fixed vulnerabilities in Django. The upstream fix for CVE-2016-2512 introduced a regression for certain applications. This update fixes the problem by applying the complete upstream regression fix. Original advisory details: Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512) Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513)
Fix available
- Published
- Updated
Stack: system
Affected products and versions
python-django Ubuntu:14.04:LTS
- Versions
- 1.5.4-1ubuntu1
- 1.6-1
- 1.6.1-1
- 1.6.1-2
- 1.6.1-2ubuntu0.1
- 1.6.1-2ubuntu0.2
- 1.6.1-2ubuntu0.3
- 1.6.1-2ubuntu0.4
- 1.6.1-2ubuntu0.5
- 1.6.1-2ubuntu0.6
- 1.6.1-2ubuntu0.8
- 1.6.1-2ubuntu0.9
- 1.6.1-2ubuntu0.10
- 1.6.1-2ubuntu0.11
- 1.6.1-2ubuntu0.12
- 1.6.1-2ubuntu0.13
- Affected ranges
- ECOSYSTEM: < 1.6.1-2ubuntu0.14
Update to 1.6.1-2ubuntu0.14