Red Hat Bugzilla – Bug 1129950
CVE-2014-0480 Django: reverse() can generate URLs pointing to other hosts, leading to phishing attacks
Last modified: 2016-04-26 13:31:09 EDT
The Django project reports the following issue: "" Django includes the helper function ``django.core.urlresolvers.reverse``, typically used to generate a URL from a reference to a view function or URL pattern name. However, when presented with input beginning with two forward-slash characters (``//``), ``reverse()`` could generate scheme-relative URLs to other hosts, allowing an attacker who is aware of unsafe use of ``reverse()`` (i.e., in a situation where an end user can control the target of a redirect, to take a common example) to generate links to sites of their choice, enabling phishing and other attacks. To remedy this, URL reversing now ensures that no URL starts with two slashes (``//``), replacing the second slash with its URL encoded counterpart (``%2F``). This approach ensures that semantics stay the same, while making the URL relative to the domain and not to the scheme. "" This issue is due to be resolved in the upstream 1.4.14, 1.5.9, 1.6.6, and 1.7 release candidate 3 releases. Acknowledgements: Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges Florian Apolloner as the original reporter.
Created attachment 926622 [details] 1.4 patch
Created attachment 926623 [details] 1.5 patch
Created attachment 926625 [details] 1.6 patch
External References: https://www.djangoproject.com/weblog/2014/aug/20/security/
Created Django14 tracking bugs for this issue: Affects: epel-6 [bug 1132776]
Created python-django15 tracking bugs for this issue: Affects: fedora-20 [bug 1132775] Affects: epel-6 [bug 1132777] Affects: epel-7 [bug 1132778]
Created python-django14 tracking bugs for this issue: Affects: fedora-all [bug 1132774]
Created python-django tracking bugs for this issue: Affects: fedora-all [bug 1132773]
python-django-1.5.9-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-django-1.6.6-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.14-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
python-django15-1.5.9-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Django14-1.4.14-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.16-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
python-django14-1.4.16-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.