====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN098
_____________________________________________________________________

DATE                : 05/04/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Django versions prior to 1.10.7,
                                    1.9.13, 1.8.18.

=====================================================================
https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
____________________________________________________________________

Django security releases issued: 1.10.7, 1.9.13, and 1.8.18
Posted by Tim Graham on avril 4, 2017

In accordance with our security release policy, the Django team is
issuing Django 1.10.7, Django 1.9.13 and 1.8.18. These release
addresses two security issues detailed below. We encourage all users of
Django to upgrade as soon as possible. The Django master and
stable/1.11.x branches are also updated. The Django 1.11 release is
forthcoming shortly in a separate blog post.


CVE-2017-7233: Open redirect and possible XSS attack via user-supplied
numeric redirect URLs

Django relies on user input in some cases (e.g.
django.contrib.auth.views.login() and i18n) to redirect the user to an
"on success" URL. The security check for these redirects (namely
django.utils.http.is_safe_url()) considered some numeric URLs (e.g.
http:999999999) "safe" when they shouldn't be.

Also, if a developer relies on is_safe_url() to provide safe redirect
targets and puts such a URL into a link, they could suffer from an XSS
attack.


CVE-2017-7234: Open redirect vulnerability in django.views.static.serve()

A maliciously crafted URL to a Django site using the
django.views.static.serve() view could redirect to any other domain.
The view no longer does any redirects as they don't provide any known,
useful functionality.

Note, however, that this view has always carried a warning that it is
not hardened for production use and should be used only as a
development aid.

Thanks Phithon Gong for reporting this issue.


Affected supported versions

    Django master development branch
    Django 1.11 (at release candidate status, final release forthcoming)
    Django 1.10
    Django 1.9
    Django 1.8

Per our supported versions policy, Django 1.7 and older are no longer
receiving security updates. Also, Django 1.9.x has reached end-of-life
-- this is the final release of that series.


Resolution

Patches to resolve the issues have been applied to Django's master
development branch and the 1.11, 1.10, 1.9, and 1.8 release branches.
The patches may be obtained from the following changesets:

On the development master branch:

    is_safe_url()
    serve()

On the 1.11 release branch:

    is_safe_url()
    serve()

On the 1.10 release branch:

    is_safe_url()
    serve()

On the 1.9 release branch:

    is_safe_url()
    serve()

On the 1.8 release branch:

    is_safe_url()
    serve()

The following releases have been issued:

    Django 1.10.7 (download Django 1.10.7 | 1.10.7 checksums)
    Django 1.9.13 (download Django 1.9.13 | 1.9.13 checksums)
    Django 1.8.18 (download Django 1.8.18 | 1.8.18 checksums)

The PGP key ID used for these releases is Tim Graham: 1E8ABDC773EDE252.


General notes regarding security reporting

As always, we ask that potential security issues be reported via
private email to security@djangoproject.com, and not via Django's Trac
instance or the django-developers list. Please see our security
policies for further information.


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================