CVE-2018-14574

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

This update for python-Django to 1.11.15 fixes the following issues:

This security issue was fixed:

• CVE-2018-14574: Prevent open redirect in django.middleware.common.CommonMiddleware (bsc#1102680).

These non-security issues were fixed:

• Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+
• Fixed a regression that could result in large memory usage when making edits using ModelAdmin.list_editable
• Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed
• Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary
• Fixed a regression where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed a regression where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets

This update for python-Django1 to version 1.11.15 fixes the following issues:

The following security vulnerability was fixed:

• CVE-2018-14574: Fixed an open redirect possibility in CommonMiddleware (boo#1102680)

The following other bugs were fixed:

• Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+
• Fixed a regression where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary
• Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed
• Fixed a regression where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns

This update was imported from the openSUSE:Leap:15.0:Update update project.

This update for python-Django fixes the following issues:

• CVE-2023-24580: Prevent DOS in file uploads. (boo#1208082)

update to 1.11.15

• CVE-2018-14574: Fixed Open redirect possibility in CommonMiddleware (boo#1102680)
• Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+
• Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable
• Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed
• Fixed a regression in Django 1.11.8 where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary
• Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed a regression in Django 1.11 where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets

• Update to 1.11.11

  • Fixes CVE-2018-7536, CVE-2018-7537

• Update to 1.11.10 LTS

  • Fixes CVE-2018-6188 boo#1077714, CVE-2017-7234, CVE-2017-7233, CVE-2017-12794

• Change Requires: python-Pillow to python-imaging for compatibility with SLE-12 which provides PIL instead of Pillow.

• Update to 1.9.9

  Bugfixes

  • Fixed invalid HTML in template postmortem on the debug page (#26938).
  • Fixed some GIS database function crashes on MySQL 5.7 (#26657).

• Update to 1.9.8 Fix XSS in admin’s add/change related popup (boo#988420) Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn’t identified there, out of an abundance of caution it’s also updated to use textContent. Bugfixes

  • Fixed missing varchar/text_pattern_ops index on CharField and TextField respectively when using AddField on PostgreSQL (#26889).
  • Fixed makemessages crash on Python 2 with non-ASCII file names (#26897).

• Update to 1.9.7 Bugfixes

  • Removed the need for the request context processor on the admin login page to fix a regression in 1.9 (#26558).
  • Fixed translation of password validators’ help_text in forms (#26544).
  • Fixed a regression causing the cached template loader to crash when using lazy template names (#26603).
  • Fixed on_commit callbacks execution order when callbacks make transactions (#26627).
  • Fixed HStoreField to raise a ValidationError instead of crashing on non-dictionary JSON input (#26672).
  • Fixed dbshell crash on PostgreSQL with an empty database name (#26698).
  • Fixed a regression in queries on a OneToOneField that has to_field and primary_key=True (#26667).

• Update to 1.9.6 Bugfixes

  • Added support for relative path redirects to the test client and to SimpleTestCase.assertRedirects() because Django 1.9 no longer converts redirects to absolute URIs (#26428).
  • Fixed TimeField microseconds round-tripping on MySQL and SQLite (#26498).
  • Prevented makemigrations from generating infinite migrations for a model field that references a functools.partial (#26475).
  • Fixed a regression where SessionBase.pop() returned None rather than raising a KeyError for nonexistent values (#26520).
  • Fixed a regression causing the cached template loader to crash when using template names starting with a dash (#26536).
  • Restored conversion of an empty string to null when saving values of GenericIPAddressField on SQLite and MySQL (#26557).
  • Fixed a makemessages…

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

This update for python-Django fixes the following issues:

• CVE-2018-14574: Prevent open redirect in django.middleware.common.CommonMiddleware (bsc#1102680)

This update for ardana and crowbar fixes the following issues:

• Restrict rootwrap directories for cinder (bsc#1132542)
• Change Cinder default log level from DEBUG to INFO (SCRD-7132)
• Remove configuration from migration (bsc#1126391)
• Configurable innodb flush options (SCRD-7496)
• Secure designate's rootwrap files (bsc#1132542)
• specify rootwrap config file in designate sudoer (bsc#1132542)
• Update Designate log threshold from DEBUG to INFO (SCRD-8459)
• Change Glance default log level from DEBUG to INFO (SCRD-8592)
• Change Heat default log level from DEBUG to INFO (SCRD-7132)
• Fix Horizon missing create snapshot action for users (bsc#1130593)
• Don't set external-name in ardana-ci models (SCRD-7471)
• Fix fail-over/-back behavior of haproxy for galera (bsc#1122875)
• Update swift endpoints from keystone-reconfigure.yml if needed (SCRD-8703)
• Change Magnum default log level from DEFAULT to INFO (SCRD-7132)
• Rip out vertica related code (SCRD-9031)
• Tighten neutron sudoers to only execute rootwrap (bsc#1132542)
• Change Neutron default log level from DEBUG to INFO (SCRD-7132)
• SCRD-9031 Change permitted nova-rootwrap config file pattern (bsc#1132542)
• specify rootwrap config file in nova sudoer (bsc#1132542)
• Change Nova default log level from DEBUG to INFO (SCRD-7132)
• Stop installing a sudoers root escalator (SCRD-9031)
• Change Octavia default log level from DEBUG to INFO (SCRD-7132)
• Increase number of connect retries (SCRD-7496)
• UDEV rules for multi-port nics (SCRD-8329)
• Ensure that the ceph group exists (SCRD-8347)
• Disable test_create_health_monitor_with_scenarios tempest (SOC-9176)
• Make --os-test-timeout configurable and increase default (SCRD-7496)
• Disable TestVolumeBootPattern.test_volume_boot_pattern (SCRD-9015)
• Increase and make timeout values configurable (SCRD-7496)
• Configure heat boot config template path (SCRD-7496)
• Fix typo on ceilometer filter (SCRD-7496)
• barclamp: Fix setting MTU on networks using a bridge
• Fix order of values in nodes piechart
• Ignore CVE-2019-11068 during Travis (SOC-9262)
• Fix cloud-mkcloud9-job-backup-restore (SCRD-7126)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• pacemaker: add failure nodes to sync fail message (bsc#1083721)
• update suse-branding.patch (SOC-9297)
• pacemaker: wait more for founder if SBD is configured (SCRD-8462)
• pacemaker: don't check cluster members on founder (SCRD-8462)
• database: Make wsrep_provider_options configurable (fate#327745)
• database: Raise and align promote/demote timeouts (bsc#1131791)
• mysql: improve galera HA setup (bsc#1122875)
• Update suse-branding.patch with correct links for documentation (SCRD-8294)
• neutron: Fix the rest of the keystone related settings for LBaaS
• neutron: properly define neutron lbaas region (bsc#1128753)
• CLM - update MariaDB manually (bsc#1132852, SOC-9022)
• update MariaDB manually (bsc#1132852, SOC-9022)
• SOC8 alarm table restructure ((SCRD-7710, bsc#1124170)
• Fix bsc#1118003
• add deprecation decision tree (shrub) (SCRD-8530)
• add cert section (SCRD-5542)
• grammar; make migration pairing more explicit (SCRD-7595)
• Remove whitespace on top of login page (SCRD-7142)
• Revert alert and form colors to default SCRD-6919
• Change active sidebar section text white SCRD-6919
• Updated the openstack-monasca-agent-sudoers file (bsc#1132542)
• Don't restart neutron-ovs-cleanup on RPM update (bsc#1132860)
• Fix KeyError in OVS firewall (bsc#1131712, CVE-2019-10876)
• update to 1.11.20 (bsc#124991, CVE-2019-6975):
• Memory exhaustion in django.utils.numberformat.format()
• Include ops-console logs if exist (bsc-1126912)
• Add a sed pattern to censor passwords from servers.yml (bsc#1105559)
• Show the status file of crowbar upgrade (if it exists)

Andreas Hug discovered that Django contained an open redirect in CommonMiddleware. A remote attacker could possibly use this issue to perform phishing attacks.