Security update for python-Django

SUSE Security Update: Security update for python-Django
Announcement ID: SUSE-SU-2015:1109-1
Rating: moderate
References: #913053 #913055 #913056 #923172 #923176
Affected Products:
  • SUSE Enterprise Storage 1.0
    		•

    An update that fixes 5 vulnerabilities is now available.

    Description:

    python-django was updated to 1.6.11 to fix security issues and
    non-security bugs.

    The following vulnerabilities were fixed:

    * Made is_safe_url() reject URLs that start with control characters to
    mitigate possible XSS attack via user-supplied redirect URLs
    (bnc#923176, CVE-2015-2317)
    * Fixed an infinite loop possibility in strip_tags() (bnc#923172,
    CVE-2015-2316)
    * WSGI header spoofing via underscore/dash conflation (bnc#913053,
    CVE-2015-0219)
    * Mitigated possible XSS attack via user-supplied redirect URLs
    * Denial-of-service attack against ``django.views.static.serve``
    (bnc#913056, CVE-2015-0221)
    * Database denial-of-service with ``ModelMultipleChoiceField``
    (bnc#913055, CVE-2015-0222)

    The update also contains fixes for non-security bugs, functional and
    stability issues.

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Enterprise Storage 1.0:
      zypper in -t patch SUSE-Storage-1.0-2015-271=1

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Enterprise Storage 1.0 (noarch):
      • python-Django-1.6.11-4.1

    References: