Bug 1090593 (CVE-2014-0474)

Summary:	CVE-2014-0474 python-django: MySQL typecasting
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, athomas, ayoung, bkabrda, bkearney, chrisw, gkotton, jdornak, katello-bugs, kseifried, lhh, markmc, mhroncok, michel, mrunge, rbryant, rhos-maint, sclewis, tjay, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	django 1.4.11, django 1.5.6, django 1.6.3, django 1.7b2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-26 23:40:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1027766, 1090687, 1090689
Bug Blocks:	1090594, 1129960

Description Vincent Danen 2014-04-23 16:58:35 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2014-0474 to
the following vulnerability:

Name: CVE-2014-0474
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0474
Assigned: 20131219
Reference: https://www.djangoproject.com/weblog/2014/apr/21/security/

The (1) FilePathField, (2) GenericIPAddressField, and (3)
IPAddressField model field classes in Django before 1.4.11, 1.5.x
before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not
properly perform type conversion, which allows remote attackers to
have unspecified impact and vectors, related to "MySQL typecasting."

Comment 1 Vincent Danen 2014-04-23 17:07:54 UTC

This has been addressed in Fedora 20 and EPEL6:

https://admin.fedoraproject.org/updates/Django14-1.4.11-1.el6
https://admin.fedoraproject.org/updates/python-django15-1.5.6-1.fc20
https://admin.fedoraproject.org/updates/python-django14-1.4.11-1.fc20
https://admin.fedoraproject.org/updates/python-django-1.6.3-1.fc20

Comment 4 Martin Prpič 2014-04-28 11:49:14 UTC

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges the Ruby on Rails team, and specifically Michael Koziarski, as the original reporters.

Comment 5 errata-xmlrpc 2014-04-30 19:04:55 UTC

This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2014:0457 https://rhn.redhat.com/errata/RHSA-2014-0457.html

Comment 6 errata-xmlrpc 2014-04-30 19:05:30 UTC

This issue has been addressed in following products:

  OpenStack 4 for RHEL 6

Via RHSA-2014:0456 https://rhn.redhat.com/errata/RHSA-2014-0456.html