SUSE-SU-2015:1109-1: moderate: Security update for python-Django

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for python-Django
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:1109-1
Rating:             moderate
References:         #913053 #913055 #913056 #923172 #923176 
Cross-References:   CVE-2015-0219 CVE-2015-0221 CVE-2015-0222
                    CVE-2015-2316 CVE-2015-2317
Affected Products:
                    SUSE Enterprise Storage 1.0
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   python-django was updated to 1.6.11 to fix security issues and
   non-security bugs.

   The following vulnerabilities were fixed:

   * Made is_safe_url() reject URLs that start with control characters to
     mitigate possible XSS attack via user-supplied redirect URLs
     (bnc#923176, CVE-2015-2317)
   * Fixed an infinite loop possibility in strip_tags() (bnc#923172,
     CVE-2015-2316)
   * WSGI header spoofing via underscore/dash conflation (bnc#913053,
     CVE-2015-0219)
   * Mitigated possible XSS attack via user-supplied redirect URLs
   * Denial-of-service attack against ``django.views.static.serve``
     (bnc#913056, CVE-2015-0221)
   * Database denial-of-service with ``ModelMultipleChoiceField``
     (bnc#913055, CVE-2015-0222)

   The update also contains fixes for non-security bugs, functional and
   stability issues.


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Enterprise Storage 1.0:

      zypper in -t patch SUSE-Storage-1.0-2015-271=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Enterprise Storage 1.0 (noarch):

      python-Django-1.6.11-4.1


References:

   https://www.suse.com/security/cve/CVE-2015-0219.html
   https://www.suse.com/security/cve/CVE-2015-0221.html
   https://www.suse.com/security/cve/CVE-2015-0222.html
   https://www.suse.com/security/cve/CVE-2015-2316.html
   https://www.suse.com/security/cve/CVE-2015-2317.html
   https://bugzilla.suse.com/913053
   https://bugzilla.suse.com/913055
   https://bugzilla.suse.com/913056
   https://bugzilla.suse.com/923172
   https://bugzilla.suse.com/923176