Security update for python-Django
This update for python-Django fixes the following issues: Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304) - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284) - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451) - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450) - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047) - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050) - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-Django fixes the following issues: Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. (bsc#1083305) - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. (bsc#1083304) - CVE-2017-12794: Fixed XSS possibility in traceback section of technical 500 debug page (bsc#1056284) - CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() (bsc#1031451) - CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs (bsc#1031450) - CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True (bsc#1008047) - CVE-2016-9013: User with hardcoded password created when running tests on Oracle (bsc#1008050) - CVE-2016-7401: CSRF protection bypass on a site with Google Analytics (bsc#1001374)
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1001374
- https://bugzilla.suse.com/1008047
- https://bugzilla.suse.com/1008050
- https://bugzilla.suse.com/1031450
- https://bugzilla.suse.com/1031451
- https://bugzilla.suse.com/1056284
- https://bugzilla.suse.com/1083304
- https://bugzilla.suse.com/1083305
- https://www.suse.com/security/cve/CVE-2016-7401
- https://www.suse.com/security/cve/CVE-2016-9013
- https://www.suse.com/security/cve/CVE-2016-9014
- https://www.suse.com/security/cve/CVE-2017-12794
- https://www.suse.com/security/cve/CVE-2017-7233
- https://www.suse.com/security/cve/CVE-2017-7234
- https://www.suse.com/security/cve/CVE-2018-7536
- https://www.suse.com/security/cve/CVE-2018-7537
- https://www.suse.com/support/update/announcement/2018/suse-su-20180973-1/