Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1609031 - (CVE-2018-14574) CVE-2018-14574 django: Open redirect possibility in CommonMiddleware
CVE-2018-14574 django: Open redirect possibility in CommonMiddleware
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180801:1400,...
: Security
Depends On: 1611050 1611051 1612125 1617844 1617846 1617847 1617849 1617851 1617853 1617855 1617857 1635700 1635701 1642590 1611052
Blocks: 1609035
  Show dependency treegraph
 
Reported: 2018-07-26 14:58 EDT by Laura Pardo
Modified: 2018-10-24 14:04 EDT (History)
38 users (show)

See Also:
Fixed In Version: Django 2.1, Django 2.0.8, Django 1.11.15
Doc Type: If docs needed, set a value
Doc Text:
When using the django.middleware.common.CommonMiddleware class with the APPEND_SLASH setting enabled, Django projects which accept paths ending in a slash may be vulnerable to an unvalidated HTTP redirect.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Laura Pardo 2018-07-26 14:58:57 EDT
A flaw was found in Django. If the django.middleware.common.CommonMiddleware and the APPEND_SLASH setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks.
Comment 2 James Hebden 2018-08-01 22:38:32 EDT
Created python-django tracking bugs for this issue:

Affects: epel-7 [bug 1611050]
Affects: fedora-all [bug 1611052]


Created python-django16 tracking bugs for this issue:

Affects: epel-7 [bug 1611051]
Comment 3 Miro Hrončok 2018-08-02 04:56:43 EDT
Note that there is also:

https://src.fedoraproject.org/rpms/python2-django1.11

And:

https://src.fedoraproject.org/rpms/python-django/branch/1.6 (1.6 modular build of Django for Fedora)
Comment 9 Riccardo Schirone 2018-10-23 05:15:30 EDT
Statement:

This issue did not affect the versions of python-django as shipped with Red Hat Update Infrastructure 3 as the vulnerable code was introduced in a newer version of the package.

Note You need to log in before you can comment on or make changes to this bug.