MGASA-2015-0026
- Source
- https://advisories.mageia.org/MGASA-2015-0026.html
- Import Source
- https://advisories.mageia.org/MGASA-2015-0026.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2015-0026
- Related
- Published
- 2015-01-17T22:31:08Z
- Modified
- 2015-01-17T22:23:02Z
- Summary
- Updated python-django and python-django14 packages fix security vulnerabilities
- Details
-
Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).
Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).
Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).
Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / python-django14
Package
- Name
- python-django14
- Purl
- pkg:rpm/mageia/python-django14?distro=mageia-4
Mageia:4 / python-django
Package
- Name
- python-django
- Purl
- pkg:rpm/mageia/python-django?distro=mageia-4