The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

python-django update version to 1.2.7 fixes several security issues including denial of service, CSRF and information leaks:
https://www.djangoproject.com/weblog/2011/sep/10/127/

Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework :

  - CVE-2011-4136     When using memory-based sessions and caching, Django     sessions are stored directly in the root namespace of     the cache. When user data is stored in the same cache, a     remote user may take over a session.

  - CVE-2011-4137, CVE-2011-4138     Django's field type URLfield by default checks supplied     URL's by issuing a request to it, which doesn't time     out. A Denial of Service is possible by supplying     specially prepared URL's that keep the connection open     indefinately or fill the Django's server memory.

  - CVE-2011-4139     Django used X-Forwarded-Host headers to construct full     URL's. This header may not contain trusted input and     could be used to poison the cache.

  - CVE-2011-4140     The CSRF protection mechanism in Django does not     properly handle web-server configurations supporting     arbitrary HTTP Host headers, which allows remote     attackers to trigger unauthenticated forged requests.

ID	Name	Product	Family	Type	Severity
74633	openSUSE Security Update : python-django (openSUSE-SU-2012:0653-1)	Nessus	SuSE Local Security Checks	Local	medium
56671	Debian DSA-2332-1 : python-django - several issues	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2011-4140

high

Tenable Plugins

medium

medium