Bug 1437234 (CVE-2017-7233)

Summary: CVE-2017-7233 python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aortega, apevec, bcourt, bkabrda, bkearney, cbillett, chrisw, cvsbot-xmlrpc, hvyas, jakub.dornak, jal233, jjoyce, jmatthew, jschluet, kbasil, kseifried, lhh, lpeer, markmc, mburns, mhroncok, michel, mmccune, mrike, mrunge, ohadlevy, rbryant, rchan, rhos-maint, sclewis, security-response-team, sisharma, slinaber, slong, smooge, srevivo, tdecacqu, tjay, tlestach, tomckay, tsanders, ttereshc
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-django 1.8.18, python-django 1.9.13, python-django 1.10.7, python-django 1.11 Doc Type: If docs needed, set a value
Doc Text:
A redirect flaw, where the is_safe_url() function did not correctly sanitize numeric-URL user input, was found in python-django. A remote attacker could exploit this flaw to perform XSS attacks against the OpenStack dashboard.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-10-31 23:54:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1437734, 1437735, 1437736, 1437737, 1437739, 1469881, 1488634, 1488635, 1488636, 1488637, 1543945, 1543946    
Bug Blocks: 1437237    
Attachments:
Description Flags
Upstream patch 1.10.x
none
Upstream patch 1.8.x
none
Upstream patch 1.9.x
none
Upstream patch 1.11.x
none
Upstream patch master
none
Backport to 1.6.11 none

Description Adam Mariš 2017-03-29 20:36:33 UTC 
Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n to redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs (e.g. http:999999999) "safe" when they shouldn't be.

Also, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Affected versions:
* Django master development branch
* Django 1.11 (currently at release candidate status)
* Django 1.10
* Django 1.9
* Django 1.8
Comment 1 Adam Mariš 2017-03-29 20:36:54 UTC 
Acknowledgments:

Name: the Django project
Comment 2 Adam Mariš 2017-03-29 20:45:50 UTC 
Created attachment 1267353 [details]
Upstream patch 1.10.x
Comment 3 Adam Mariš 2017-03-29 20:46:28 UTC 
Created attachment 1267354 [details]
Upstream patch 1.8.x
Comment 4 Adam Mariš 2017-03-29 20:46:54 UTC 
Created attachment 1267355 [details]
Upstream patch 1.9.x
Comment 5 Adam Mariš 2017-03-29 20:47:26 UTC 
Created attachment 1267356 [details]
Upstream patch 1.11.x
Comment 6 Adam Mariš 2017-03-29 20:47:53 UTC 
Created attachment 1267357 [details]
Upstream patch master
Comment 8 Andrej Nemec 2017-04-05 12:51:25 UTC 
Public via:

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Comment 9 Lon Hohberger 2017-04-06 19:13:48 UTC 
Created attachment 1269476 [details]
Backport to 1.6.11
Comment 10 errata-xmlrpc 2017-06-14 15:24:59 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 9.0 (Mitaka)

Via RHSA-2017:1462 https://access.redhat.com/errata/RHSA-2017:1462
Comment 11 errata-xmlrpc 2017-06-14 15:27:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2017:1451 https://access.redhat.com/errata/RHSA-2017:1451
Comment 12 errata-xmlrpc 2017-06-14 15:32:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2017:1445 https://access.redhat.com/errata/RHSA-2017:1445
Comment 13 errata-xmlrpc 2017-06-14 15:36:26 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2017:1470 https://access.redhat.com/errata/RHSA-2017:1470
Comment 14 errata-xmlrpc 2017-06-28 15:19:54 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:1596 https://access.redhat.com/errata/RHSA-2017:1596
Comment 16 Summer Long 2017-09-05 22:38:12 UTC 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1488635]


Created python-django tracking bugs for this issue:

Affects: epel-7 [bug 1488634]
Affects: fedora-all [bug 1488636]
Comment 20 errata-xmlrpc 2017-10-31 17:22:04 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 (Ocata)

Via RHSA-2017:3093 https://access.redhat.com/errata/RHSA-2017:3093
Comment 23 Kurt Seifried 2018-02-09 15:50:24 UTC 
Statement:

This issue affects the versions of python-django as shipped with Red Hat Satellite 6. Please note that python-django, as used by Pulp does not make use of the Pulp doesn't use "is_safe_url" directly or the "i18n" views or the "django.contrib.auth" Login view. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 25 errata-xmlrpc 2018-10-16 15:19:01 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.4 for RHEL 7

Via RHSA-2018:2927 https://access.redhat.com/errata/RHSA-2018:2927