Bug 1129959 (CVE-2014-0483) - CVE-2014-0483 Django: data leakage via querystring manipulation in admin
Summary: CVE-2014-0483 Django: data leakage via querystring manipulation in admin
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2014-0483
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1132773 1132774 1132775 1132776 1132777 1132778
Blocks: 1129960
TreeView+ depends on / blocked
 
Reported: 2014-08-14 05:07 UTC by Murray McAllister
Modified: 2019-09-29 13:20 UTC (History)
22 users (show)

Fixed In Version: django 1.4.14, django 1.5.9, django 1.6.6, django 1.7-rc3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-26 23:40:18 UTC


Attachments (Terms of Use)
1.4 patch (7.18 KB, patch)
2014-08-14 05:10 UTC, Murray McAllister
no flags Details | Diff
1.5 patch (8.46 KB, patch)
2014-08-14 05:10 UTC, Murray McAllister
no flags Details | Diff
1.6 patch (10.21 KB, patch)
2014-08-14 05:10 UTC, Murray McAllister
no flags Details | Diff

Description Murray McAllister 2014-08-14 05:07:56 UTC
The Django project reports the following issue:

""
Django's administrative interface, ``django.contrib.admin``, offers a
feature whereby related objects can be displayed for selection in a
popup window. The mechanism for this relies on placing values in the
URL and querystring which specify the related model to display and the
field through which the relationship is implemented. This mechanism
does perform permission checks at the level of the model class as a
whole.

This mechanism did not, however, verify that the specified field
actually represents a relationship between models. Thus a user with
access to the admin interface, and with sufficient knowledge of model
structure and the appropriate URLs, could constructed popup views
which would display the values of non-relationship fields, including
fields the application developer had not intended to expose in such a
fashion.

To remedy this, the admin interface will now, in addition to its
normal permission checks, verify that the specified field does indeed
represent a relationship, to a model registered with the admin, and
will raise an exception if either condition is not true.
""

This issue is due to be resolved in the upstream 1.4.14, 1.5.9, 1.6.6, and 1.7 release candidate 3 releases.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges Collin Anderson as the original reporter.

Comment 2 Murray McAllister 2014-08-14 05:10:11 UTC
Created attachment 926648 [details]
1.4 patch

Comment 3 Murray McAllister 2014-08-14 05:10:30 UTC
Created attachment 926649 [details]
1.5 patch

Comment 4 Murray McAllister 2014-08-14 05:10:51 UTC
Created attachment 926650 [details]
1.6 patch

Comment 5 Murray McAllister 2014-08-22 03:42:58 UTC
External References:

https://www.djangoproject.com/weblog/2014/aug/20/security/

Comment 6 Murray McAllister 2014-08-22 03:58:16 UTC
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1132776]

Comment 7 Murray McAllister 2014-08-22 03:58:21 UTC
Created python-django15 tracking bugs for this issue:

Affects: fedora-20 [bug 1132775]
Affects: epel-6 [bug 1132777]
Affects: epel-7 [bug 1132778]

Comment 8 Murray McAllister 2014-08-22 03:58:25 UTC
Created python-django14 tracking bugs for this issue:

Affects: fedora-all [bug 1132774]

Comment 9 Murray McAllister 2014-08-22 03:58:29 UTC
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1132773]

Comment 10 Fedora Update System 2014-09-09 22:27:15 UTC
python-django-1.6.6-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-09-09 22:27:35 UTC
python-django14-1.4.14-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-09-10 13:29:49 UTC
python-django15-1.5.9-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2014-09-24 03:46:04 UTC
Django14-1.4.14-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2014-12-01 18:58:45 UTC
python-django14-1.4.16-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2014-12-01 18:59:49 UTC
python-django14-1.4.16-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.