| Revision Date: | 2014-06-23 | Version: | 21 |
| Title: | DSA-2163-1 python-django -- multiple |
| Description: | Several vulnerabilities were discovered in the django web development framework: CVE-2011-0696 For several reasons the internal CSRF protection was not used to validate ajax requests in the past. However, it was discovered that this exception can be exploited with a combination of browser plugins and redirects and thus is not sufficient. CVE-2011-0697 It was discovered that the file upload form is prone to cross-site scripting attacks via the file name. It is important to note that this update introduces minor backward incompatibilities due to the fixes for the above issues. Packages in the oldstable distribution are not affected by these problems. |
| Family: | unix | Class: | patch |
| Status: | ACCEPTED | Reference(s): | CVE-2011-0696
CVE-2011-0697
DSA-2163-1
|
| Platform(s): | Debian GNU/kFreeBSD 6.0
Debian GNU/Linux 6.0
| Product(s): | python-django
|
| Definition Synopsis |
| Debian 6.0 is installed AND GNU/Linux or GNU/kFreeBSD kernel
Debian GNU/Linux is installed
OR Debian GNU/kFreeBSD is installed
AND Installed architecture is all
AND python-django DPKG is earlier than 1.2.3-3+squeeze1
|