Bug 1090592 (CVE-2014-0473)

Summary:	CVE-2014-0473 python-django: caching of anonymous pages could reveal CSRF token
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, athomas, ayoung, bkabrda, bkearney, chrisw, gkotton, jdornak, katello-bugs, kseifried, lhh, markmc, mhroncok, michel, mrunge, rbryant, rhos-maint, sclewis, tjay, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	django 1.4.11, django 1.5.6, django 1.6.3, django 1.7b2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-26 23:40:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1027766, 1090687, 1090689
Bug Blocks:	1090594, 1129960

Description Vincent Danen 2014-04-23 16:56:56 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0473 to
the following vulnerability:

Name: CVE-2014-0473
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0473
Assigned: 20131219
Reference: https://www.djangoproject.com/weblog/2014/apr/21/security/

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6,
1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF
token for all anonymous users, which allows remote attackers to bypass
CSRF protections by reading the CSRF cookie for anonymous users.

Comment 1 Vincent Danen 2014-04-23 17:07:27 UTC

This has been addressed in Fedora 20 and EPEL6:

https://admin.fedoraproject.org/updates/Django14-1.4.11-1.el6
https://admin.fedoraproject.org/updates/python-django15-1.5.6-1.fc20
https://admin.fedoraproject.org/updates/python-django14-1.4.11-1.fc20
https://admin.fedoraproject.org/updates/python-django-1.6.3-1.fc20

Comment 4 Murray McAllister 2014-04-24 01:50:07 UTC

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges Paul McMillan as the original reporter.

Comment 5 errata-xmlrpc 2014-04-30 19:04:50 UTC

This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2014:0457 https://rhn.redhat.com/errata/RHSA-2014-0457.html

Comment 6 errata-xmlrpc 2014-04-30 19:05:25 UTC

This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:0456 https://rhn.redhat.com/errata/RHSA-2014-0456.html