Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New python-django packages fix cross site request forgery |
| Informations | |||
|---|---|---|---|
| Name | DSA-1640 | First vendor Publication | 2008-09-20 |
| Vendor | Debian | Last vendor Modification | 2008-09-20 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.8 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorized modification of data through cross site request forgery. The is possible regardless of the Django plugin to prevent cross site request forgery being enabled. The Common Vulnerabilities and Exposures project identifies this issue as CVE-2008-3909. In this update the affected feature is disabled; this is in accordance with upstream's preferred solution for this situation. This update takes the opportunity to also include a relatively minor denial of service attack in the internationalisaton framework, known as CVE-2007-5712. For the stable distribution (etch), these problems have been fixed in version 0.95.1-1etch2. For the unstable distribution (sid), these problems have been fixed in version 1.0-1. We recommend that you upgrade your python-django package. |
Original Source
| Url : http://www.debian.org/security/2008/dsa-1640 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-399 | Resource Management Errors |
| 50 % | CWE-352 | Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18143 | |||
| Oval ID: | oval:org.mitre.oval:def:18143 | ||
| Title: | DSA-1640-1 python-django - cross site request forgery | ||
| Description: | Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorised modification of data through cross site request forgery. This is possible regardless of the Django plugin to prevent cross site request forgery being enabled. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1640-1 CVE-2008-3909 CVE-2007-5712 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | python-django |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8091 | |||
| Oval ID: | oval:org.mitre.oval:def:8091 | ||
| Title: | DSA-1640 python-django -- several vulnerabilities | ||
| Description: | Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorised modification of data through cross site request forgery. This is possible regardless of the Django plugin to prevent cross site request forgery being enabled. The Common Vulnerabilities and Exposures project identifies this issue as CVE-2008-3909. In this update the affected feature is disabled; this is in accordance with upstream’s preferred solution for this situation. This update takes the opportunity to also include a relatively minor denial of service attack in the internationalisation framework, known as CVE-2007-5712. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1640 CVE-2008-3909 CVE-2007-5712 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | python-django |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-02-27 | Name : Fedora Update for Django FEDORA-2007-2788 File : nvt/gb_fedora_2007_2788_Django_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for Django FEDORA-2007-3157 File : nvt/gb_fedora_2007_3157_Django_fc7.nasl |
| 2009-02-17 | Name : Fedora Update for Django FEDORA-2008-4191 File : nvt/gb_fedora_2008_4191_Django_fc7.nasl |
| 2009-02-17 | Name : Fedora Update for Django FEDORA-2008-7288 File : nvt/gb_fedora_2008_7288_Django_fc8.nasl |
| 2008-09-24 | Name : Debian Security Advisory DSA 1640-1 (python-django) File : nvt/deb_1640_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 48046 | Django Administration Application Unauthenticated HTTP POST Request Handling ... |
| 38905 | Django Internationalization Framework USE_I18N Option Multiple HTTP Request R... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-04-23 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2008-185.nasl - Type : ACT_GATHER_INFO |
| 2008-09-23 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1640.nasl - Type : ACT_GATHER_INFO |
| 2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7288.nasl - Type : ACT_GATHER_INFO |
| 2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7672.nasl - Type : ACT_GATHER_INFO |
| 2008-05-22 | Name : The remote Fedora host is missing a security update. File : fedora_2008-4191.nasl - Type : ACT_GATHER_INFO |
| 2007-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2788.nasl - Type : ACT_GATHER_INFO |
| 2007-11-12 | Name : The remote Fedora host is missing a security update. File : fedora_2007-3157.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:27:53 |
|
