489214 – <dev-python/django-{1.4.6,1.5.2}: XSS vulnerability in is_safe_url function (CVE-2013-6044)

Bug 489214 - <dev-python/django-{1.4.6,1.5.2}: XSS vulnerability in is_safe_url function (CVE-2013-6044)

Summary: <dev-python/django-{1.4.6,1.5.2}: XSS vulnerability in is_safe_url function (...

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2013-10-24 00:19 UTC by GLSAMaker/CVETool Bot
Modified:	2013-12-03 10:28 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2013-10-24 00:19:43 UTC

CVE-2013-6044 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6044):
  The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6,
  1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even
  if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS)
  or other vulnerabilities into Django applications that use this function, as
  demonstrated by "the login view in django.contrib.auth.views" and the
  javascript: scheme.


Need cleanup.

Comment 1 Chris Reffett (RETIRED) gentoo-dev

2013-12-03 01:35:05 UTC

Maintainer timeout, cleaned up. GLSA vote: no.

Comment 2 Sergey Popov gentoo-dev

2013-12-03 10:28:31 UTC

GLSA vote: no

Closing noglsa