Bug 1355663 (CVE-2016-6186)
| Summary: | CVE-2016-6186 django: XSS in admin's add/change related popup | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aortega, apevec, athomas, ayoung, bkearney, cbillett, chrisw, cvsbot-xmlrpc, jschluet, kbasil, kseifried, lhh, lpeer, markmc, mrunge, rbryant, sclewis, security-response-team, sisharma, slong, sparks, srevivo, tdecacqu, tomckay |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | django 1.9.8, django 1.8.14 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related pop-up. Element.textContent is now used to prevent XSS data execution.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-12-16 00:13:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1356326, 1356327, 1356328, 1356330, 1356331, 1357701, 1357702, 1357703, 1357704, 1357726, 1357727 | ||
| Bug Blocks: | 1355664 | ||
|
Description
Andrej Nemec
2016-07-12 07:54:41 UTC
Acknowledgements: Name: the upstream Django project Created Django14 tracking bugs for this issue: Affects: epel-6 [bug 1357702] Created python-django15 tracking bugs for this issue: Affects: epel-6 [bug 1357703] Created python-django tracking bugs for this issue: Affects: fedora-all [bug 1357701] Affects: epel-7 [bug 1357704] Created python-django-openstack-auth tracking bugs for this issue: Affects: openstack-rdo [bug 1357727] Created python-django-horizon tracking bugs for this issue: Affects: openstack-rdo [bug 1357726] This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 Operational Tools for RHEL 7 Via RHSA-2016:1594 https://rhn.redhat.com/errata/RHSA-2016-1594.html This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2016:1595 https://rhn.redhat.com/errata/RHSA-2016-1595.html This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) Via RHSA-2016:1596 https://rhn.redhat.com/errata/RHSA-2016-1596.html |