Red Hat Security AdvisoryRHSA-2016:0504
python-django security update
Released 2016-03-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-django-1.8.11-1.el7ost, python-django-bash-completion-1.8.11-1.el7ost, python-django-doc-1.8.11-1.el7ost
Fixes 2 records
Priority LOW 39
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (X…
CVSS 3.0HIGH 7.4· Network · No auth · User interaction · EPSS 0.04053 · Published 2016-04-08 · Partial fix · 1.8.10, 1.9.3 CWE-79
Priority LOW 21
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
CVSS 3.0LOW 3.1· Network · No auth · User interaction · EPSS 0.03409 · Published 2016-04-08 · Partial fix · 1.8.10, 1.9.3 CWE-200
