Red Hat Security Advisory

RHSA-2013:1521

python-django security update

Released 2013-11-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 3.0 Django14-1.4.8-1.el6ost, Django14-doc-1.4.8-1.el6ost

Fixes 2 records

TI-2013-03780 CVE-2013-4315 · GHSA-vjjp-9r83-22rc

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and…

LOW 29

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followe…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0327 Published 2013-09-16 Partial fix · 1.4.7, 1.5.3 CWE-22

TI-2013-05154 CVE-2013-6044 · GHSA-9cwg-mhxf-hh59

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before…

LOW 24

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02307 Published 2013-10-04 Partial fix · 1.4.6, 1.5.2 CWE-79