The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.

A cross-site request forgery vulnerability was discovered in Django that, if exploited, could be used to perform unrequested deletion or modification of data. Updated versions of Django will now discard posts from users whose sessions have expired, so data will need to be re-entered in these cases (CVE-2008-3909).

The versions of Django shipping with Mandriva Linux have been updated to the latest patched versions that include the fix for this issue. In addition, they provide other bug fixes.

Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorized modification of data through cross site request forgery. This is possible regardless of the Django plugin to prevent cross site request forgery being enabled. The Common Vulnerabilities and Exposures project identifies this issue as CVE-2008-3909.

In this update the affected feature is disabled; this is in accordance with upstream's preferred solution for this situation.

This update takes the opportunity to also include a relatively minor denial of service attack in the internationalisation framework, known as CVE-2007-5712.

Update to upstream version 0.96.3 that fixes cross-site request forgery (CSRF) issue that may occur after user re-authentication after expiration of current session:
http://www.djangoproject.com/weblog/2008/sep/02/security/ This issue also affected deployments with Django's bundled CSRF-protection module activated.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37030	Mandriva Linux Security Advisory : python-django (MDVSA-2008:185)	Nessus	Mandriva Local Security Checks	medium
34253	Debian DSA-1640-1 : python-django - several vulnerabilities	Nessus	Debian Local Security Checks	medium
34142	Fedora 9 : Django-0.96.3-1.fc9 (2008-7672)	Nessus	Fedora Local Security Checks	medium
34125	Fedora 8 : Django-0.96.3-1.fc8 (2008-7288)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-3909

high

Tenable Plugins

medium

medium

medium

medium