CVE-2019-3498

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

An upstream patch has been backported to fix a security vulnerability in python-django. CVE-2019-3498: Content spoofing possibility in the default 404 page

An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view. The URL path is no longer displayed in the default 404 template and the request_path context variable is now quoted to fix the issue for custom templates that use the path.

It was discovered that Django incorrectly handled the default 404 page. A remote attacker could use this issue to spoof content using a malicious URL (CVE-2019-3498).

These are all security issues fixed in the python36-Django-3.2.7-2.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django-4.2.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:

Security fixes included ins this update:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

memcached (to version 1.5.17)

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str()n (bsc#1149110).
• CVE-2019-11596: Fixed a denial of service in the 'lru' command (bsc#1133817)
• CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification attacks (bsc#1083903).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse(bsc#1068612).

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue through specially crafted requests (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)
• CVE-2020-11076: Fixed HTTP Request smuggling through invalid Transfer-Encoding header.
• CVE-2020-5247: Fixed HTTP Response Splitting through newline characters handling (bsc#1165402)

zookeeper:

• CVE-2019-0201: Fixed an information disclosure related to getACL() (bsc#1135773).

Non security fixes included in this update:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in crowbar-core:

• Update to version 4.0+git.1580209654.1d112d31f:
  • network: start OVS before wickedd (SOC-11067)

Changes in crowbar-ha:

• Update to version 4.0+git.1585316203.d6ad2c8:
  • [4.0] add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 4.0+git.1589804581.9972163f0:

  • [4.0] magnum: fix check for image/flavor (SOC-11251)

• Update to version 4.0+git.1589647351.ccfd9481f:

  • [4.0] trove: fix rabbitmq connection URL (SOC-11286)

• Update to version 4.0+git.1589458214.9f765aa08:

  • [4.0] Fix create magnum k8s image and flavor (SOC-11251)

• Update to version 4.0+git.1588271860.131fc8cc1:

  • run keystone_register on cluster founder only when HA (SOC-11248)
  • nova: run…

This update for python-Django fixes the following issues:

Security issue fixed:

• CVE-2019-3498: Fixed a content spoofing attack in the default 404 page (bsc#1120932)

This update for ardana and crowbar fixes the following issues:

• Restrict rootwrap directories for cinder (bsc#1132542)
• Change Cinder default log level from DEBUG to INFO (SCRD-7132)
• Remove configuration from migration (bsc#1126391)
• Configurable innodb flush options (SCRD-7496)
• Secure designate's rootwrap files (bsc#1132542)
• specify rootwrap config file in designate sudoer (bsc#1132542)
• Update Designate log threshold from DEBUG to INFO (SCRD-8459)
• Change Glance default log level from DEBUG to INFO (SCRD-8592)
• Change Heat default log level from DEBUG to INFO (SCRD-7132)
• Fix Horizon missing create snapshot action for users (bsc#1130593)
• Don't set external-name in ardana-ci models (SCRD-7471)
• Fix fail-over/-back behavior of haproxy for galera (bsc#1122875)
• Update swift endpoints from keystone-reconfigure.yml if needed (SCRD-8703)
• Change Magnum default log level from DEFAULT to INFO (SCRD-7132)
• Rip out vertica related code (SCRD-9031)
• Tighten neutron sudoers to only execute rootwrap (bsc#1132542)
• Change Neutron default log level from DEBUG to INFO (SCRD-7132)
• SCRD-9031 Change permitted nova-rootwrap config file pattern (bsc#1132542)
• specify rootwrap config file in nova sudoer (bsc#1132542)
• Change Nova default log level from DEBUG to INFO (SCRD-7132)
• Stop installing a sudoers root escalator (SCRD-9031)
• Change Octavia default log level from DEBUG to INFO (SCRD-7132)
• Increase number of connect retries (SCRD-7496)
• UDEV rules for multi-port nics (SCRD-8329)
• Ensure that the ceph group exists (SCRD-8347)
• Disable test_create_health_monitor_with_scenarios tempest (SOC-9176)
• Make --os-test-timeout configurable and increase default (SCRD-7496)
• Disable TestVolumeBootPattern.test_volume_boot_pattern (SCRD-9015)
• Increase and make timeout values configurable (SCRD-7496)
• Configure heat boot config template path (SCRD-7496)
• Fix typo on ceilometer filter (SCRD-7496)
• barclamp: Fix setting MTU on networks using a bridge
• Fix order of values in nodes piechart
• Ignore CVE-2019-11068 during Travis (SOC-9262)
• Fix cloud-mkcloud9-job-backup-restore (SCRD-7126)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• pacemaker: add failure nodes to sync fail message (bsc#1083721)
• update suse-branding.patch (SOC-9297)
• pacemaker: wait more for founder if SBD is configured (SCRD-8462)
• pacemaker: don't check cluster members on founder (SCRD-8462)
• database: Make wsrep_provider_options configurable (fate#327745)
• database: Raise and align promote/demote timeouts (bsc#1131791)
• mysql: improve galera HA setup (bsc#1122875)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• neutron: Fix the rest of the keystone related settings for LBaaS
• neutron: properly define neutron lbaas region (bsc#1128753)
• CLM - update MariaDB manually (bsc#1132852, SOC-9022)
• update MariaDB manually (bsc#1132852, SOC-9022)
• SOC8 alarm table restructure ((SCRD-7710, bsc#1124170)
• Fix bsc#1118003
• add deprecation decision tree (shrub) (SCRD-8530)
• add cert section (SCRD-5542)
• grammar; make migration pairing more explicit (SCRD-7595)
• Remove whitespace on top of login page (SCRD-7142)
• Revert alert and form colors to default SCRD-6919
• Change active sidebar section text white SCRD-6919
• Updated the openstack-monasca-agent-sudoers file (bsc#1132542)
• Don't restart neutron-ovs-cleanup on RPM update (bsc#1132860)
• Fix KeyError in OVS firewall (bsc#1131712, CVE-2019-10876)
• update to 1.11.20 (bsc#124991, CVE-2019-6975):
• Memory exhaustion in django.utils.numberformat.format()
• Include ops-console logs if exist (bsc-1126912)
• Add a sed pattern to censor passwords from servers.yml (bsc#1105559)
• Show the status file of crowbar upgrade (if it exists)

This update for python-Django fixes the following issues:

• CVE-2019-12781: Added incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).
• CVE-2019-3498: Fixed a content spoofing via crafted URL in the default 404 page (bsc#1120932).

It was discovered that Django incorrectly handled the default 404 page. A remote attacker could use this issue to spoof content using a malicious URL.