SUSE-SU-2014:0851-1: moderate: Security update for python-django

sle-updates at sle-updates at
Fri Jun 27 17:04:14 MDT 2014

   SUSE Security Update: Security update for python-django

Announcement ID:    SUSE-SU-2014:0851-1
Rating:             moderate
References:         #874950 #874955 #874956 #877993 #878641 
Cross-References:   CVE-2014-0472 CVE-2014-0473 CVE-2014-0474
                    CVE-2014-1418 CVE-2014-3730
Affected Products:
                    SUSE Cloud 3

   An update that fixes 5 vulnerabilities is now available. It
   includes one version update.


   python-django was updated to fix the following security issues:

       * Unexpected code execution using reverse(). (CVE-2014-0472)
       * Caching of anonymous pages could reveal CSRF token. (CVE-2014-0473)
       * Inproper MySQL typecasting for FilePathField, GenericIPAddressField,
         and IPAddressField model field classes. (CVE-2014-0474)
       * Prevent caches poisoning. (CVE-2014-1418)
       * Ensure malformed URLs from user input are validated. (CVE-2014-3730).

   Further information is available at
   > and
   <> .

   Security Issues references:

       * CVE-2014-0472
       * CVE-2014-0473
       * CVE-2014-0474
       * CVE-2014-1418
       * CVE-2014-3730

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Cloud 3:

      zypper in -t patch sleclo30sp3-python-django-9290

   To bring your system up-to-date, use "zypper patch".

Package List:

   - SUSE Cloud 3 (x86_64) [New Version: 1.5.8]:



More information about the sle-updates mailing list