SUSE-SU-2014:0851-1: moderate: Security update for python-django

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for python-django
______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:0851-1
Rating:             moderate
References:         #874950 #874955 #874956 #877993 #878641 
Cross-References:   CVE-2014-0472 CVE-2014-0473 CVE-2014-0474
                    CVE-2014-1418 CVE-2014-3730
Affected Products:
                    SUSE Cloud 3
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available. It
   includes one version update.

Description:


   python-django was updated to fix the following security issues:

       * Unexpected code execution using reverse(). (CVE-2014-0472)
       * Caching of anonymous pages could reveal CSRF token. (CVE-2014-0473)
       * Inproper MySQL typecasting for FilePathField, GenericIPAddressField,
         and IPAddressField model field classes. (CVE-2014-0474)
       * Prevent caches poisoning. (CVE-2014-1418)
       * Ensure malformed URLs from user input are validated. (CVE-2014-3730).

   Further information is available at
   https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
   <https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
   > and https://www.djangoproject.com/weblog/2014/apr/21/security/
   <https://www.djangoproject.com/weblog/2014/apr/21/security/> .

   Security Issues references:

       * CVE-2014-0472
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0472>
       * CVE-2014-0473
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0473>
       * CVE-2014-0474
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0474>
       * CVE-2014-1418
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1418>
       * CVE-2014-3730
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3730>


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Cloud 3:

      zypper in -t patch sleclo30sp3-python-django-9290

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Cloud 3 (x86_64) [New Version: 1.5.8]:

      python-django-1.5.8-0.7.1


References:

   http://support.novell.com/security/cve/CVE-2014-0472.html
   http://support.novell.com/security/cve/CVE-2014-0473.html
   http://support.novell.com/security/cve/CVE-2014-0474.html
   http://support.novell.com/security/cve/CVE-2014-1418.html
   http://support.novell.com/security/cve/CVE-2014-3730.html
   https://bugzilla.novell.com/874950
   https://bugzilla.novell.com/874955
   https://bugzilla.novell.com/874956
   https://bugzilla.novell.com/877993
   https://bugzilla.novell.com/878641
   http://download.suse.com/patch/finder/?keywords=44f05acc7b3321c1c776f63dfc9355ec