Bug 446402 (CVE-2008-2302)

Summary:	CVE-2008-2302 Django: administration application XSS
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	michel
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-06-19 10:54:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	447257, 447258, 447259, 447260
Bug Blocks:

Description Tomas Hoger 2008-05-14 14:05:55 UTC

Following advisory was published by Django security team:

  http://www.djangoproject.com/weblog/2008/may/14/security/

Description:
The Django administration application will, when accessed by a user who is not
sufficiently authenticated, display a login form and ask the user to provide the
necessary credentials before displaying the requested page. This form will be
submitted to the URL the user attempted to access, by supplying the current
request path as the value of the form's "action" attribute.

The value of the request path was not being escaped, creating an opportunity for
a cross-site scripting (XSS) attack by leading a user to a URL which contained
URL-encoded HTML and/or JavaScript in the request path.

Affected versions:
trunk, 0.96, 0.95, 0.91

Upstream patches:
0.96: http://code.djangoproject.com/changeset/7527
trunk: http://code.djangoproject.com/changeset/7521
(see upstream advisory for 0.95 and 0.91 patches)

Fixed upstream versions:
0.96.2, 0.95.3, 0.91.2

Affected versions shipped in F7, F8, F9, rawhide and EPEL5.

Comment 2 Fedora Update System 2008-05-21 10:57:41 UTC

Django-0.96.2-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2008-05-21 11:04:01 UTC

Django-0.96.2-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2008-05-21 11:06:21 UTC

Django-0.96.2-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Red Hat Product Security 2008-06-19 10:54:50 UTC

This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-4191
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-4248
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-4267