The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.

python-django was updated to 1.4.5 to fix various security issues and bugs.

Update to 1.4.5 :

  - Security release.

  - Fix bnc#807175 / bnc#787521 / CVE-2012-4520 /     CVE-2013-0305 / CVE-2013-0306 and CVE-2013-1665.

  - Update to 1.4.3 :

  - Security release :

  - Host header poisoning

  - Redirect poisoning

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/dec/10/securit     y

  - Add a symlink from /usr/bin/django-admin.py to     /usr/bin/django-admin

  - Update to 1.4.2 :

  - Security release :

  - Host header poisoning

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/oct/17/securit     y

  - Update to 1.4.1 :

  - Security release :

  - Cross-site scripting in authentication views

  - Denial-of-service in image validation

  - Denial-of-service via get_image_dimensions()

  - Please check release notes for details:
    https://www.djangoproject.com/weblog/2012/jul/30/securit     y-releases-issued

  - Add patch to support CSRF_COOKIE_HTTPONLY config

update fix CVE-2013-0305, CVE-2013-0306

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Django-1.4.4, security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

James Kettle discovered that Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users. Although this issue had been previously addressed in USN-1632-1, this update adds additional hardening measures to host header validation. This update also adds a new ALLOWED_HOSTS setting that can be set to a list of acceptable values for headers. (CVE-2012-4520)

Orange Tsai discovered that Django incorrectly performed permission checks when displaying the history view in the admin interface. An administrator could use this flaw to view the history of any object, regardless of intended permissions. (CVE-2013-0305)

It was discovered that Django incorrectly handled a large number of forms when generating formsets. An attacker could use this flaw to cause Django to consume memory, resulting in a denial of service.
(CVE-2013-0306)

It was discovered that Django incorrectly deserialized XML. An attacker could use this flaw to perform entity-expansion and external-entity/DTD attacks. This updated modified Django behaviour to no longer allow DTDs, perform entity expansion, or fetch external entities/DTDs. (CVE-2013-1664, CVE-2013-1665).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-4520     James Kettle discovered that Django did not properly     filter the HTTP Host header when processing certain     requests. An attacker could exploit this to generate and     cause parts of Django, particularly the password-reset     mechanism, to display arbitrary URLs to users.

  - CVE-2013-0305     Orange Tsai discovered that the bundled administrative     interface of Django could expose supposedly-hidden     information via its history log.

  - CVE-2013-0306     Mozilla discovered that an attacker can abuse Django's     tracking of the number of forms in a formset to cause a     denial-of-service attack due to extreme memory     consumption.

  - CVE-2013-1665     Michael Koziarski discovered that Django's XML     deserialization is vulnerable to entity-expansion and     external-entity/DTD attacks.

The Django Project reports :

These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities.

- Host header poisoning

an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack.
These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to.

Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading.

- Formset denial-of-service

an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone.

- XML attacks

Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework.

- Data leakage via admin history log

Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.

ID	Name	Product	Family	Severity
75089	openSUSE Security Update : python-django (openSUSE-SU-2013:1203-1)	Nessus	SuSE Local Security Checks	medium
65233	Fedora 17 : Django-1.4.5-1.fc17 (2013-2874)	Nessus	Fedora Local Security Checks	medium
65232	Fedora 18 : python-django-1.4.5-2.fc18 (2013-2843)	Nessus	Fedora Local Security Checks	medium
65096	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django vulnerabilities (USN-1757-1)	Nessus	Ubuntu Local Security Checks	medium
64898	Debian DSA-2634-1 : python-django - several vulnerabilities	Nessus	Debian Local Security Checks	medium
64873	FreeBSD : django -- multiple vulnerabilities (21c59f5e-7cc5-11e2-9c11-080027a5ec9a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-0306

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium