Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1355663 - (CVE-2016-6186) CVE-2016-6186 django: XSS in admin's add/change related popup
CVE-2016-6186 django: XSS in admin's add/change related popup
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160718,repor...
: Security
Depends On: 1357703 1357704 1356326 1356327 1356328 1356330 1356331 1357701 1357702 1357726 1357727
Blocks: 1355664
  Show dependency tree / graph
 
Reported: 2016-07-12 03:54 EDT by Andrej Nemec
Modified: 2016-12-15 19:13 EST (History)
24 users (show)

See Also:
Fixed In Version: django 1.9.8, django 1.8.14
Doc Type: If docs needed, set a value
Doc Text:
A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related pop-up. Element.textContent is now used to prevent XSS data execution.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-12-15 19:13:39 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1594 normal SHIPPED_LIVE Moderate: python-django security update 2016-08-10 23:44:08 EDT
Red Hat Product Errata RHSA-2016:1595 normal SHIPPED_LIVE Moderate: python-django security update 2016-08-11 00:04:09 EDT
Red Hat Product Errata RHSA-2016:1596 normal SHIPPED_LIVE Moderate: python-django security update 2016-08-11 01:23:19 EDT

  None (edit)
Description Andrej Nemec 2016-07-12 03:54:41 EDT 
XSS vulnerability was found in django. Unsafe usage of JavaScript's ``Element.innerHTML`` could result in XSS in the admin's add/change related popup. ``Element.textContent`` is now used to prevent execution of the data.

The debug view also used ``innerHTML``. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use ``textContent``.
Comment 2 Summer Long 2016-07-12 19:39:21 EDT 
Acknowledgements:

Name: the upstream Django project
Comment 8 Summer Long 2016-07-18 20:15:29 EDT 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1357702]
Comment 9 Summer Long 2016-07-18 20:15:41 EDT 
Created python-django15 tracking bugs for this issue:

Affects: epel-6 [bug 1357703]
Comment 10 Summer Long 2016-07-18 20:15:52 EDT 
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1357701]
Affects: epel-7 [bug 1357704]
Comment 11 Summer Long 2016-07-18 20:53:42 EDT 
Created python-django-openstack-auth tracking bugs for this issue:

Affects: openstack-rdo [bug 1357727]
Comment 12 Summer Long 2016-07-18 20:53:52 EDT 
Created python-django-horizon tracking bugs for this issue:

Affects: openstack-rdo [bug 1357726]
Comment 16 errata-xmlrpc 2016-08-10 19:44:17 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 Operational Tools for RHEL 7

Via RHSA-2016:1594 https://rhn.redhat.com/errata/RHSA-2016-1594.html
Comment 17 errata-xmlrpc 2016-08-10 20:04:20 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2016:1595 https://rhn.redhat.com/errata/RHSA-2016-1595.html
Comment 18 errata-xmlrpc 2016-08-10 21:23:28 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2016:1596 https://rhn.redhat.com/errata/RHSA-2016-1596.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.