Detections
Analytics
Debian DLA-143-1 : python-django security update
medium Nessus Plugin ID 82126
Language:
Synopsis
The remote Debian host is missing a security update.Description
Multiple security issues have been found in Django:https://www.djangoproject.com/weblog/2015/jan/13/security/
For Debian 6 Squeeeze, they have been fixed in version 1.2.3-3+squeeze12 of python-django. Here is what the upstream developers have to say about those issues :
CVE-2015-0219 - WSGI header spoofing via underscore/dash conflation
When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_. For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus also in Django's request.META dictionary).
Unfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER. This means that if a header is used in a security-sensitive way (for instance, passing authentication information along from a front-end proxy), even if the proxy carefully strips any incoming value for X-Auth-User, an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection.
In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is not recommended for production use, but matching the behavior of common production servers reduces the surface area for behavior changes during deployment.
CVE-2015-0220 - Possible XSS attack via user-supplied redirect URLs
Django relies on user input in some cases (e.g.
django.contrib.auth.views.login() and i18n) to redirect the user to an 'on success' URL. The security checks for these redirects (namely django.util.http.is_safe_url()) didn't strip leading whitespace on the tested URL and as such considered URLs like '\njavascript:...' safe.
If a developer relied on is_safe_url() to provide safe redirect targets and put such a URL into a link, they could suffer from a XSS attack. This bug doesn't affect Django currently, since we only put this URL into the Location response header and browsers seem to ignore JavaScript there.
CVE-2015-0221 - denial of service attack against django.views.static.serve
In older versions of Django, the django.views.static.serve() view read the files it served one line at a time. Therefore, a big file with no newlines would result in memory usage equal to the size of that file.
An attacker could exploit this and launch a denial of service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage.
Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Now may be a good time to audit your project and serve your files in production using a real front-end web server if you are not doing so.
Note that the version of Django in use in Debian 6 Squeeze was not affected by CVE-2015-0222 (Database denial of service with ModelMultipleChoiceField) since that feature does not exist in this version.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected python-django, and python-django-doc packages.See Also
https://lists.debian.org/debian-lts-announce/2015/01/msg00017.html
https://packages.debian.org/source/squeeze-lts/python-django
Plugin Details
Severity: Medium
ID: 82126
File Name: debian_DLA-143.nasl
Version: 1.8
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 3/26/2015
Updated: 1/11/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:python-django, p-cpe:/a:debian:debian_linux:python-django-doc, cpe:/o:debian:debian_linux:6.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 1/29/2015
Vulnerability Publication Date: 1/16/2015