Oval Definition:	oval:org.opensuse.security:def:20177233
Revision Date: 2022-06-30 Version: 1 Title: CVE-2017-7233 Description: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. Family: unix Class: vulnerability Status: Reference(s): CVE-2017-7233 SUSE-SU-2018:0973-1 SUSE-SU-2018:1102-1 openSUSE-SU-2018:0632-1 openSUSE-SU-2018:0824-1 openSUSE-SU-2018:0826-1 Mitre CVE-2017-7233 SUSE CVE-2017-7233 SUSE-SU-2018:0973-1 SUSE-SU-2018:1102-1 openSUSE-SU-2018:0632-1 openSUSE-SU-2018:0824-1 openSUSE-SU-2018:0826-1 Platform(s): openSUSE Leap 42.3 openSUSE Tumbleweed SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 6 SUSE OpenStack Cloud 7 SUSE Package Hub for SUSE Linux Enterprise 12 Product(s): Definition Synopsis SUSE Package Hub for SUSE Linux Enterprise 12 is installed AND python-Django-1.11.10-5 is installed Definition Synopsis SUSE OpenStack Cloud 7 is installed AND python-Django-1.8.19-3.4.1 is installed Definition Synopsis SUSE OpenStack Cloud 6 is installed AND python-Django-1.8.19-3.6 is installed Definition Synopsis openSUSE Leap 42.3 is installed AND Package Information python-Django-1.8.19-6.4 is installed AND python-Django is signed with openSUSE key OR python3-Django-1.8.19-5.3 is installed AND python3-Django is signed with openSUSE key Definition Synopsis openSUSE Tumbleweed is installed AND Package Information python36-Django-3.2.7-2.3 is installed OR python38-Django-3.2.7-2.3 is installed OR python39-Django-3.2.7-2.3 is installed Definition Synopsis SUSE Package Hub for SUSE Linux Enterprise 12 is installed AND python-Django-1.11.10-5.1 is installed
BACK