6.8 - USN-1066-1

A security issue affects the following Ubuntu releases:

Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 9.10:
python-django 1.1.1-1ubuntu1.2

Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.3

Ubuntu 10.10:
python-django 1.2.3-1ubuntu0.2.10.10.2

ATTENTION: This update introduces a small backwards-imcompatible change to perform full CSRF validation on all requests. Prior to this update, AJAX requests were excepted from CSRF protections. For more details, please see http://docs.djangoproject.com/en/1.2/releases/1.2.5/.

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery (CSRF) attacks. (CVE-2011-0696)

It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting (XSS) vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-0697)