SUSE-SU-2018:1830-1: moderate: Security update for python-Django

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for python-Django
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1830-1
Rating:             moderate
References:         #1083304 #1083305 #967999 
Cross-References:   CVE-2016-2512 CVE-2018-7536 CVE-2018-7537
                   
Affected Products:
                    SUSE Enterprise Storage 5
______________________________________________________________________________

   An update that fixes three vulnerabilities is now available.

Description:

   This update for python-Django fixes the following security issues:

   - CVE-2016-2512: The utils.http.is_safe_url function allowed remote
     attackers to redirect users to arbitrary web sites and conduct phishing
     attacks or possibly conduct cross-site scripting (XSS) attacks via a URL
     containing basic authentication (bsc#967999).
   - CVE-2018-7536: The django.utils.html.urlize() function was extremely
     slow to evaluate certain inputs due to catastrophic backtracking
     vulnerabilities (bsc#1083304).
   - CVE-2018-7537: If django.utils.text.Truncator's chars() and words()
     methods were passed the html=True argument, they were extremely slow to
     evaluate certain inputs due to a catastrophic backtracking vulnerability
     in a regular expression (bsc#1083305).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Enterprise Storage 5:

      zypper in -t patch SUSE-Storage-5-2018-1237=1



Package List:

   - SUSE Enterprise Storage 5 (noarch):

      python-Django-1.6.11-6.5.1


References:

   https://www.suse.com/security/cve/CVE-2016-2512.html
   https://www.suse.com/security/cve/CVE-2018-7536.html
   https://www.suse.com/security/cve/CVE-2018-7537.html
   https://bugzilla.suse.com/1083304
   https://bugzilla.suse.com/1083305
   https://bugzilla.suse.com/967999