Bug 1437236 (CVE-2017-7234)

Summary: CVE-2017-7234 python-django: Open redirect vulnerability in django.views.static.serve()
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: apevec, ayoung, bkearney, cbillett, chrisw, cvsbot-xmlrpc, hvyas, jakub.dornak, jal233, jjoyce, jschluet, kbasil, lhh, lpeer, markmc, mhroncok, michel, mrunge, rbryant, sclewis, security-response-team, sisharma, slong, smooge, srevivo, tdecacqu, tomckay
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-django 1.8.18, python-django 1.9.13, python-django 1.10.7, python-django 1.11 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:09:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1437237    
Attachments:
Description Flags
Upstream patch 1.8.x
none
Upstream patch 1.9.x
none
Upstream patch 1.10.x
none
Upstream patch 1.11.x
none
Upstream patch master none

Description Adam Mariš 2017-03-29 20:40:40 UTC 
A maliciously crafted URL to a Django site using the serve() view could redirect to any other domain. The view no longer does any redirects as they don't provide any known, useful functionality.

Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid.

Affected versions:
* Django master development branch
* Django 1.11 (currently at release candidate status)
* Django 1.10
* Django 1.9
* Django 1.8
Comment 1 Adam Mariš 2017-03-29 20:40:58 UTC 
Acknowledgments:

Name: the Django project
Comment 2 Adam Mariš 2017-03-29 20:48:25 UTC 
Created attachment 1267358 [details]
Upstream patch 1.8.x
Comment 3 Adam Mariš 2017-03-29 20:48:47 UTC 
Created attachment 1267359 [details]
Upstream patch 1.9.x
Comment 4 Adam Mariš 2017-03-29 20:49:10 UTC 
Created attachment 1267360 [details]
Upstream patch 1.10.x
Comment 5 Adam Mariš 2017-03-29 20:49:32 UTC 
Created attachment 1267361 [details]
Upstream patch 1.11.x
Comment 6 Adam Mariš 2017-03-29 20:49:54 UTC 
Created attachment 1267362 [details]
Upstream patch master
Comment 9 Andrej Nemec 2017-04-05 12:51:31 UTC 
Public via:

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/