SUSE-SU-2018:1828-1: moderate: Security update for python-Django

sle-security-updates at sle-security-updates at
Wed Jun 27 10:11:46 MDT 2018

   SUSE Security Update: Security update for python-Django

Announcement ID:    SUSE-SU-2018:1828-1
Rating:             moderate
References:         #1083304 #1083305 #967999 
Cross-References:   CVE-2016-2512 CVE-2018-7536 CVE-2018-7537
Affected Products:
                    SUSE Enterprise Storage 4

   An update that fixes three vulnerabilities is now available.


   This update for python-Django fixes the following security issues:

   - CVE-2016-2512: The utils.http.is_safe_url function allowed remote
     attackers to redirect users to arbitrary web sites and conduct phishing
     attacks or possibly conduct cross-site scripting (XSS) attacks via a URL
     containing basic authentication (bsc#967999).
   - CVE-2018-7536: The django.utils.html.urlize() function was extremely
     slow to evaluate certain inputs due to catastrophic backtracking
     vulnerabilities (bsc#1083304)
   - CVE-2018-7537: If django.utils.text.Truncator's chars() and words()
     methods were passed the html=True argument, they were extremely slow to
     evaluate certain inputs due to a catastrophic backtracking vulnerability
     in a regular expression (bsc#1083305)

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Enterprise Storage 4:

      zypper in -t patch SUSE-Storage-4-2018-1235=1

Package List:

   - SUSE Enterprise Storage 4 (noarch):



More information about the sle-security-updates mailing list