Bug 1781269 (CVE-2019-19118) - CVE-2019-19118 django: privilege escalation in the django admin
Summary: CVE-2019-19118 django: privilege escalation in the django admin
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-19118
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1781270 1781271 1781272 1781273 1781312 1781361 1807059
Blocks: 1781274
TreeView+ depends on / blocked
 
Reported: 2019-12-09 16:50 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-12-14 18:47 UTC (History)
34 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-02-27 09:49:32 UTC
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2019-12-09 16:50:47 UTC
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

Reference:
https://www.openwall.com/lists/oss-security/2019/12/02/1

Comment 1 Guilherme de Almeida Suckevicz 2019-12-09 16:51:12 UTC
Created python-django tracking bugs for this issue:

Affects: epel-7 [bug 1781271]
Affects: epel-8 [bug 1781272]
Affects: fedora-all [bug 1781270]
Affects: openstack-rdo [bug 1781273]

Comment 2 Miro Hrončok 2019-12-09 16:56:10 UTC
This does not affect Django 1.x? Because that's what we ship in EPEL 7. And in the Django module. And in the python2-django1.11 package.

This does not affect Django 3.0?  Because that's what we ship in Fedora 32 (rawhide).

Comment 3 Miro Hrončok 2019-12-09 16:58:57 UTC
3.0 is affected as well, according to https://www.openwall.com/lists/oss-security/2019/12/02/1

1.x is probably unsupported at this point, so we would need to find out ourselves. May I ask to open Bugzillas for https://src.fedoraproject.org/modules/django and https://src.fedoraproject.org/rpms/python2-django1.11 ?

Comment 4 Guilherme de Almeida Suckevicz 2019-12-09 18:16:03 UTC
Created python2-django1.11 tracking bugs for this issue:

Affects: fedora-all [bug 1781312]

Comment 5 Guilherme de Almeida Suckevicz 2019-12-09 18:20:45 UTC
(In reply to Miro Hrončok from comment #3)
> 3.0 is affected as well, according to
> https://www.openwall.com/lists/oss-security/2019/12/02/1
> 
> 1.x is probably unsupported at this point, so we would need to find out
> ourselves. May I ask to open Bugzillas for
> https://src.fedoraproject.org/modules/django and
> https://src.fedoraproject.org/rpms/python2-django1.11 ?

Please use the following trackers:
django: https://bugzilla.redhat.com/show_bug.cgi?id=1781270
python2-django1.11: https://bugzilla.redhat.com/show_bug.cgi?id=1781312

Comment 6 Miro Hrončok 2019-12-09 19:19:55 UTC
(In reply to Guilherme de Almeida Suckevicz from comment #5)
> (In reply to Miro Hrončok from comment #3)
> > 3.0 is affected as well, according to
> > https://www.openwall.com/lists/oss-security/2019/12/02/1
> > 
> > 1.x is probably unsupported at this point, so we would need to find out
> > ourselves. May I ask to open Bugzillas for
> > https://src.fedoraproject.org/modules/django and
> > https://src.fedoraproject.org/rpms/python2-django1.11 ?
> 
> Please use the following trackers:
> django: https://bugzilla.redhat.com/show_bug.cgi?id=1781270


This is for the nonmodular package. Since the modular one is in completely different version, different upstream and different Fedora maintainer, could you please create a separate bug for the module?

Comment 7 Guilherme de Almeida Suckevicz 2019-12-09 21:01:36 UTC
Created django:1.6/python-django tracking bugs for this issue:

Affects: fedora-all [bug 1781361]

Comment 9 Hardik Vyas 2019-12-30 08:35:31 UTC
External References:

https://www.djangoproject.com/weblog/2019/dec/02/security-releases/

Comment 10 Hardik Vyas 2019-12-30 09:27:20 UTC
Statement:

The version of Django shipped with Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and Red Hat Ceph Storage 3 is not affected, as edit-permissions are not enabled.

Comment 12 Nick Tait 2020-01-30 23:39:13 UTC
RHOSP 13 and 15 are unaffected as the vulnerable code was not yet introduced.

Comment 13 Nick Tait 2020-01-30 23:45:54 UTC
Mitigation:

This issue can only be resolved by applying updates.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 16 Yadnyawalk Tale 2020-02-27 07:21:42 UTC
Pulp2 owns/carries django-1 and in this case not affected by CVE-2019-19118.

Pulp3 chose 2.2 because that is Django's Long-Term-Support version. We do *not* carry/own django-2.2, and pick up whatever "latest" is from the repos. Since 2.2.8 has the fix for flaw, and it was released in December, we're already patched here.

# Satellite 6.6.2 -- 
==> rpm -q --whatrequires python-django
pulp-server-2.19.1.1-1.el7sat.noarch
==> rpm -qa | grep django
python2-django-1.11.13-1.el7sat.noarch

# Satellite 6.7.0 (snap 13) -- 
==> rpm -q --whatrequires python-django
pulp-server-2.21.0-1.el7sat.noarch
==> rpm -qa | grep django
python2-django-1.11.13-1.el7sat.noarch

We are not affected in Satellite.

Comment 17 Product Security DevOps Team 2020-02-27 09:49:32 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19118


Note You need to log in before you can comment on or make changes to this bug.