The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.

- Mon Jan 3 2011 Steve 'Ashcrow' Milner <me at     stevemilner.org> - 1.2.4-1

    - Update for multiple security issues (see       http://www.djangoproject.com/weblog/2010/dec/22/securi       ty/)

    - Sat Oct 9 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.3-3

    - Now build docs for F12+

    - Added Django-remove-djangodocs-ext.patch

    - Sat Oct 9 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.3-2

    - Moved to dirhtml for documentation generation

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Jan 3 2011 Steve 'Ashcrow' Milner <me at     stevemilner.org> - 1.2.4-1

    - Update for multiple security issues (see       http://www.djangoproject.com/weblog/2010/dec/22/securi       ty/)

    - Sat Oct 9 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.3-3

    - Now build docs for F12+

    - Added Django-remove-djangodocs-ext.patch

    - Sat Oct 9 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.3-2

    - Moved to dirhtml for documentation generation

    - Mon Sep 13 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.3-1

    - Update for       http://www.djangoproject.com/weblog/2010/sep/10/123/

    - Thu Sep 9 2010 Steve 'Ashcrow' Milner <me at       stevemilner.org> - 1.2.2-1

    - Update for CVE-2010-3082 (see       http://www.djangoproject.com/weblog/2010/sep/08/securi       ty-release/)

    - Removed Django-hash-compat-13310.patch as it is       already included in this release

    - Wed Jul 21 2010 David Malcolm <dmalcolm at redhat.com>
      - 1.2.1-6

    - Rebuilt for       https://fedoraproject.org/wiki/Features/Python_2.7/Mas       sRebuild

    - Tue Jun 8 2010 Steve 'Ashcrow' Milner <stevem at       gnulinux.net> - 1.2.1-5

    - Added       http://code.djangoproject.com/changeset/13310?format=d       iff&new=13310 per BZ#601212

    - Thu Jun 3 2010 Steve 'Ashcrow' Milner <stevem at       gnulinux.net> - 1.2.1-4

    - Include egg in >= rhel6

    - Thu Jun 3 2010 Michel Salim <salimma at       fedoraproject.org> - 1.2.1-3

    - Use generated %{name}.lang instead of including each       locale file by hand

    - Temporarily make main package provide -doc on Rawhide,       to fix upgrade path until upstream documentation       builds with Sphinx 1.0

  - Thu May 27 2010 Steve 'Ashcrow' Milner <stevem at     gnulinux.net> - 1.2.1-2

    - Allow for building docs in F13 as it's only F14       freaking out

    - Tue May 25 2010 Steve 'Ashcrow' Milner <stevem at       gnulinux.net> - 1.2.1-1

    - Update for new release.

    - Added lang files per BZ#584866.

    - Changed perms on       %{python_sitelib}/django/contrib/admin/media/js/compre       ss.py

    - Lots of explicit files listed in %files in order to       reduce duplicate file listings

    - Docs are not built on F-13 for now

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Adam Baldwin discovered that Django did not properly validate query string lookups. This could be exploited to provide an information leak to an attacker with admin privilieges. (CVE-2010-4534)

Paul McMillan discovered that Django did not validate the length of the token used when generating a password reset. An attacker could exploit this to cause a denial of service via resource exhaustion.
(CVE-2010-4535).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Django project reports :

Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately. Information leakage in Django administrative interface The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships.
This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering. Denial-of-service attack in password-reset mechanism Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).

ID	Name	Product	Family	Severity
51513	Fedora 14 : Django-1.2.4-1.fc14 (2011-0120)	Nessus	Fedora Local Security Checks	medium
51512	Fedora 13 : Django-1.2.4-1.fc13 (2011-0096)	Nessus	Fedora Local Security Checks	medium
51437	Ubuntu 9.10 / 10.04 LTS / 10.10 : python-django vulnerabilities (USN-1040-1)	Nessus	Ubuntu Local Security Checks	medium
51393	FreeBSD : django -- multiple vulnerabilities (14a37474-1383-11e0-8a58-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-4535

high

Tenable Plugins

medium

medium

medium

medium