CVE-2016-2512

The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.

The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com@attacker.com.

Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512)

Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513)

These are all security issues fixed in the python3-Django-1.10.4-1.1 package on the GA media of openSUSE Tumbleweed.

The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com@attacker.com.

This update for python-Django fixes the following issues:

Security issues fixed:

• CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305)
• CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304)
• CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284)
• CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451)
• CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450)
• CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047)
• CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050)
• CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
• CVE-2016-2512: Vulnerability in the function tils.http.is_safe_url could allow remote users to arbitrary web site and conduct phishing attacks. (bsc#bnc#967999)

This update for python-Django fixes the following security issues:

• CVE-2016-2512: The utils.http.is_safe_url function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication (bsc#967999).
• CVE-2018-7536: The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities (bsc#1083304)
• CVE-2018-7537: If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression (bsc#1083305)

This update for python-Django fixes the following security issues:

• CVE-2016-2512: The utils.http.is_safe_url function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication (bsc#967999).
• CVE-2018-7536: The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities (bsc#1083304).
• CVE-2018-7537: If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression (bsc#1083305).

Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512)

Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513)