CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>

python-django was updated to 1.5.10 fixing bugs and security issues:

* Prevented reverse() from generating URLs pointing to other hosts to
  prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
  file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
  prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
  manipulation. (bnc#893090, CVE-2014-0483)

Security Issues:

* CVE-2014-0480
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>

python-django was updated to 1.6.11 to fix security issues and non-security bugs.

The following vulnerabilities were fixed:

• Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)
• Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)
• WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)
• Mitigated possible XSS attack via user-supplied redirect URLs
• Denial-of-service attack against django.views.static.serve (bnc#913056, CVE-2015-0221)
• Database denial-of-service with ModelMultipleChoiceField (bnc#913055, CVE-2015-0222)

The update also contains fixes for non-security bugs, functional and stability issues.

python-django was updated to 1.6.11 to fix security issues and non-security bugs.

The following vulnerabilities were fixed:

• Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)
• Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)
• WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)
• Mitigated possible XSS attack via user-supplied redirect URLs
• Denial-of-service attack against django.views.static.serve (bnc#913056, CVE-2015-0221)
• Database denial-of-service with ModelMultipleChoiceField (bnc#913055, CVE-2015-0222)

The update also contains fixes for non-security bugs, functional and stability issues.

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments. (CVE-2015-0219)

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack. (CVE-2015-0220)

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service. (CVE-2015-0221)

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0222)