The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.

Multiple vulnerabilities has been found and corrected in python-django :

The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected static media files, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL (CVE-2009-2659).

Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression (CVE-2009-3695).

The versions of Django shipping with Mandriva Linux have been updated to the latest patched version that include the fix for this issue. In addition, they provide other bug fixes.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

A vulnerability has been found and corrected in python-django :

The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected static media files, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL (CVE-2009-2659).

The versions of Django shipping with Mandriva Linux have been updated to the latest patched version that include the fix for this issue. In addition, they provide other bug fixes.

For: http://www.djangoproject.com/weblog/2009/jul/28/security/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
42131	Mandriva Linux Security Advisory : python-django (MDVSA-2009:276-1)	Nessus	Mandriva Local Security Checks	medium
42130	Mandriva Linux Security Advisory : python-django (MDVSA-2009:275)	Nessus	Mandriva Local Security Checks	medium
40476	Fedora 11 : Django-1.0.3-6.fc11 (2009-8177)	Nessus	Fedora Local Security Checks	medium
40475	Fedora 10 : Django-1.0.3-6.fc10 (2009-8169)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-2659

high

Tenable Plugins

medium

medium

medium

medium