Bug 19690

Summary:	python-django new security issues CVE-2016-9013 and CVE-2016-9014
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	herman.viaene, lewyssmith, sysadmin-bugs
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/705373/
Whiteboard:	has_procedure MGA5-32-OK advisory MGA5-64-OK
Source RPM:	python-django-1.8.15-1.mga6.src.rpm	CVE:
Status comment:

Description David Walser 2016-11-01 15:56:46 CET

Upstream has issued an advisory today (November 1):
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/

The issues are fixed in 1.8.16.

Mageia 5 is also affected.

David Walser 2016-11-01 15:56:56 CET

Whiteboard: (none) => MGA5TOO

Comment 1 David Walser 2016-11-02 00:07:47 CET

Ubuntu has issued an advisory for this today (November 1):
https://www.ubuntu.com/usn/usn-3115-1/

Comment 2 Philippe Makowski 2016-11-02 15:06:18 CET

python-django-1.8.16-1.mga5.noarch.rpm
python-django-bash-completion-1.8.16-1.mga5.noarch.rpm
python3-django-1.8.16-1.mga5.noarch.rpm
python-django-doc-1.8.16-1.mga5.noarch.rpm

from python-django-1.8.16-1.mga5.src.rpm

Are in 5/core/updates_testing

Cauldron freeze push asked

Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=17860#c7

Advisory

CVE-2016-9013: User with hardcoded password created when running tests on Oracle

When running tests with an Oracle database, Django creates a temporary database user. In older versions, if a password isn't manually specified in the database settings TEST dictionary, a hardcoded password is used. This could allow an attacker with network access to the database server to connect.

CVE-2016-9014: DNS rebinding vulnerability when DEBUG=True

Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True. This makes them vulnerable to a DNS rebinding attack.


Ref :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9014
https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
https://www.ubuntu.com/usn/usn-3115-1/

Assignee: makowski.mageia => qa-bugs
Whiteboard: MGA5TOO => MGA5TOO has_procedure

David Walser 2016-11-02 17:12:56 CET

Version: Cauldron => 5
Whiteboard: MGA5TOO has_procedure => has_procedure

David Walser 2016-11-02 18:43:05 CET

URL: (none) => http://lwn.net/Vulnerabilities/705373/

Comment 3 Herman Viaene 2016-11-04 14:22:54 CET

MGA55-32 on Acer D620 Xfce
No installation issues.
Test procedure as refered in Comment 2 works as a breeze.

CC: (none) => herman.viaene
Whiteboard: has_procedure => has_procedure MGA5-32-OK

Comment 4 Lewis Smith 2016-11-05 19:29:22 CET

Advisory uploaded.

CC: (none) => lewyssmith
Whiteboard: has_procedure MGA5-32-OK => has_procedure MGA5-32-OK advisory

Comment 5 Lewis Smith 2016-11-06 09:55:36 CET

Testing M5-64 real H/W

Using the test procedure linked in Comment 2, both before & after the update to:
 python3-django-1.8.16-1.mga5
 python-django-1.8.16-1.mga5
 python-django-bash-completion-1.8.16-1.mga5
 python-django-doc-1.8.16-1.mga5

Results were essentially identical, with the trivial difference:-

BEFORE the update:
$ python[3] manage.py runserver
...
Quit the server with CONTROL-C.
[06/Nov/2016 08:21:15] "GET / HTTP/1.1" 200 1767
[06/Nov/2016 08:21:15] "GET /favicon.ico HTTP/1.1" 404 1936
^C

AFTER the update, these two lines were not present.  But this is clearly OK.
Validating the update.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-32-OK advisory => has_procedure MGA5-32-OK advisory MGA5-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2016-11-06 11:35:06 CET

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0368.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED