Bug 1437234 (CVE-2017-7233) - CVE-2017-7233 python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
Summary: CVE-2017-7233 python-django: Open redirect and possible XSS attack via user-s...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7233
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1437734 1437735 1437736 1437737 1437739 1469881 1488634 1488635 1488636 1488637 1543945 1543946
Blocks: 1437237
TreeView+ depends on / blocked
 
Reported: 2017-03-29 20:36 UTC by Adam Mariš
Modified: 2021-02-17 02:24 UTC (History)
42 users (show)

Fixed In Version: python-django 1.8.18, python-django 1.9.13, python-django 1.10.7, python-django 1.11
Doc Type: If docs needed, set a value
Doc Text:
A redirect flaw, where the is_safe_url() function did not correctly sanitize numeric-URL user input, was found in python-django. A remote attacker could exploit this flaw to perform XSS attacks against the OpenStack dashboard.
Clone Of:
Environment:
Last Closed: 2017-10-31 23:54:59 UTC

Attachments (Terms of Use)
Upstream patch 1.10.x (8.15 KB, patch)
2017-03-29 20:45 UTC, Adam Mariš 		no flags Details | Diff
Upstream patch 1.8.x (6.01 KB, patch)
2017-03-29 20:46 UTC, Adam Mariš 		no flags Details | Diff
Upstream patch 1.9.x (7.35 KB, patch)
2017-03-29 20:46 UTC, Adam Mariš 		no flags Details | Diff
Upstream patch 1.11.x (8.18 KB, patch)
2017-03-29 20:47 UTC, Adam Mariš 		no flags Details | Diff
Upstream patch master (7.82 KB, patch)
2017-03-29 20:47 UTC, Adam Mariš 		no flags Details | Diff
Backport to 1.6.11 (6.05 KB, patch)
2017-04-06 19:13 UTC, Lon Hohberger 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1445 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-06-14 19:19:41 UTC
Red Hat Product Errata RHSA-2017:1451 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-06-14 19:18:24 UTC
Red Hat Product Errata RHSA-2017:1462 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-06-14 19:17:35 UTC
Red Hat Product Errata RHSA-2017:1470 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-06-14 19:28:05 UTC
Red Hat Product Errata RHSA-2017:1596 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-06-28 18:53:25 UTC
Red Hat Product Errata RHSA-2017:3093 0 normal SHIPPED_LIVE Moderate: python-django security update 2017-10-31 21:21:07 UTC
Red Hat Product Errata RHSA-2018:2927 0 None None None 2018-10-16 15:19:16 UTC

Description Adam Mariš 2017-03-29 20:36:33 UTC 
Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n to redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs (e.g. http:999999999) "safe" when they shouldn't be.

Also, if a developer relies on is_safe_url() to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Affected versions:
* Django master development branch
* Django 1.11 (currently at release candidate status)
* Django 1.10
* Django 1.9
* Django 1.8
Comment 1 Adam Mariš 2017-03-29 20:36:54 UTC 
Acknowledgments:

Name: the Django project
Comment 2 Adam Mariš 2017-03-29 20:45:50 UTC 
Created attachment 1267353 [details]
Upstream patch 1.10.x
Comment 3 Adam Mariš 2017-03-29 20:46:28 UTC 
Created attachment 1267354 [details]
Upstream patch 1.8.x
Comment 4 Adam Mariš 2017-03-29 20:46:54 UTC 
Created attachment 1267355 [details]
Upstream patch 1.9.x
Comment 5 Adam Mariš 2017-03-29 20:47:26 UTC 
Created attachment 1267356 [details]
Upstream patch 1.11.x
Comment 6 Adam Mariš 2017-03-29 20:47:53 UTC 
Created attachment 1267357 [details]
Upstream patch master
Comment 8 Andrej Nemec 2017-04-05 12:51:25 UTC 
Public via:

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
Comment 9 Lon Hohberger 2017-04-06 19:13:48 UTC 
Created attachment 1269476 [details]
Backport to 1.6.11
Comment 10 errata-xmlrpc 2017-06-14 15:24:59 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 9.0 (Mitaka)

Via RHSA-2017:1462 https://access.redhat.com/errata/RHSA-2017:1462
Comment 11 errata-xmlrpc 2017-06-14 15:27:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7

Via RHSA-2017:1451 https://access.redhat.com/errata/RHSA-2017:1451
Comment 12 errata-xmlrpc 2017-06-14 15:32:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7

Via RHSA-2017:1445 https://access.redhat.com/errata/RHSA-2017:1445
Comment 13 errata-xmlrpc 2017-06-14 15:36:26 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 8.0 (Liberty)

Via RHSA-2017:1470 https://access.redhat.com/errata/RHSA-2017:1470
Comment 14 errata-xmlrpc 2017-06-28 15:19:54 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:1596 https://access.redhat.com/errata/RHSA-2017:1596
Comment 16 Summer Long 2017-09-05 22:38:12 UTC 
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1488635]


Created python-django tracking bugs for this issue:

Affects: epel-7 [bug 1488634]
Affects: fedora-all [bug 1488636]
Comment 20 errata-xmlrpc 2017-10-31 17:22:04 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 (Ocata)

Via RHSA-2017:3093 https://access.redhat.com/errata/RHSA-2017:3093
Comment 23 Kurt Seifried 2018-02-09 15:50:24 UTC 
Statement:

This issue affects the versions of python-django as shipped with Red Hat Satellite 6. Please note that python-django, as used by Pulp does not make use of the Pulp doesn't use "is_safe_url" directly or the "i18n" views or the "django.contrib.auth" Login view. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Comment 25 errata-xmlrpc 2018-10-16 15:19:01 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.4 for RHEL 7

Via RHSA-2018:2927 https://access.redhat.com/errata/RHSA-2018:2927
Note You need to log in before you can comment on or make changes to this bug.