Bug 489214

Summary:	<dev-python/django-{1.4.6,1.5.2}: XSS vulnerability in is_safe_url function (CVE-2013-6044)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2013-10-24 00:19:43 UTC

CVE-2013-6044 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6044):
  The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6,
  1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even
  if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS)
  or other vulnerabilities into Django applications that use this function, as
  demonstrated by "the login view in django.contrib.auth.views" and the
  javascript: scheme.


Need cleanup.

Comment 1 Chris Reffett (RETIRED) gentoo-dev

2013-12-03 01:35:05 UTC

Maintainer timeout, cleaned up. GLSA vote: no.

Comment 2 Sergey Popov gentoo-dev

2013-12-03 10:28:31 UTC

GLSA vote: no

Closing noglsa