Bug 29984 - python-django new security issues CVE-2022-22818 and CVE-2022-23833
Summary: python-django new security issues CVE-2022-22818 and CVE-2022-23833
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, has_procedure, validated_update
Depends on:
Blocks:
 
Reported: 2022-02-01 17:56 CET by David Walser
Modified: 2022-03-21 21:19 CET (History)
5 users (show)

See Also:
Source RPM: python-django-3.1.14-1.1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2022-02-01 17:56:17 CET
Upstream has issued an advisory today (February 1):
https://www.djangoproject.com/weblog/2022/feb/01/security-releases/

The issues are fixed upstream in 3.2.12.  3.1.x is no longer supported.

Mageia 8 is also affected.
David Walser 2022-02-01 17:56:28 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 3.2.12

Comment 1 David Walser 2022-02-02 23:46:46 CET
Debian-LTS has issued an advisory for this on February 1:
https://www.debian.org/lts/security/2022/dla-2906
Comment 2 David Walser 2022-02-03 18:39:33 CET
Ubuntu has issued an advisory for this today (February 3):
https://ubuntu.com/security/notices/USN-5269-1
Comment 3 David Walser 2022-02-11 22:00:06 CET
Fedora has issued an advisory for this today (February 11):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
Comment 4 Mike Rambo 2022-03-13 01:15:39 CET
Wally upgraded cauldron to 3.2.12 in Feb 2022.


Updated package uploaded for Mageia 8

Advisory:
========================

Updated python-django package fixes security vulnerabilities:

* The {% debug %} template tag didn't properly encode the current context posing an XSS attack vector (CVE-2022-22818).
* Passing certain inputs to multipart forms could result in an infinite loop when parsing files resulting in a denial of service (CVE-2022-23833).


References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
https://www.debian.org/lts/security/2022/dla-2906
========================

Updated packages in core/updates_testing:
========================
python3-django-3.2.12-1.mga8.noarch.rpm

from python-django-3.2.12-1.mga8.src.rpm


Test procedure: https://bugs.mageia.org/show_bug.cgi?id=29737#c3

Status comment: Fixed upstream in 3.2.12 => (none)
Assignee: python => qa-bugs
Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8
Keywords: (none) => has_procedure
CC: (none) => mhrambo3501

Comment 5 Mike Rambo 2022-03-13 17:21:28 CET
I totally forgot (wish we could edit) that there is a dependency that will be needed.

Add to the file list python3-asgiref-3.5.0-1.mga8.noarch.rpm

from python-asgiref-3.5.0-1.mga8.src.rpm



Updated packages in core/updates_testing:
========================
python3-django-3.2.12-1.mga8.noarch.rpm

from python-django-3.2.12-1.mga8.src.rpm

python3-asgiref-3.5.0-1.mga8.noarch.rpm

from python-asgiref-3.5.0-1.mga8.src.rpm
Comment 6 David Walser 2022-03-13 18:46:18 CET
Add a note to the advisory that asgiref was updated for the new django.  Also make sure the URL from Comment 0 is in the references, and if there's a release notes for Django 3.2, that would be good to include since we're switching branches.
Comment 7 Mike Rambo 2022-03-13 20:06:45 CET
Updated advisory...

Updated package uploaded for Mageia 8

Advisory:
========================

Updated python-django package fixes security vulnerabilities:

* The {% debug %} template tag didn't properly encode the current context posing an XSS attack vector (CVE-2022-22818).
* Passing certain inputs to multipart forms could result in an infinite loop when parsing files resulting in a denial of service (CVE-2022-23833).

Note that the python-django update necessitated a version update to python-asgiref as well. The files are included in the file list and python-asgiref is needed in order to install python-django.


References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22818
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23833
https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
========================

Updated packages in core/updates_testing:
========================
python3-django-3.2.12-1.mga8.noarch.rpm

from python-django-3.2.12-1.mga8.src.rpm

python3-asgiref-3.5.0-1.mga8.noarch.rpm

from python-asgiref-3.5.0-1.mga8.src.rpm

Since this update is a change from the 3.1 to the 3.2 python-django branch a link to the release notes for the 3.2 branch is included.

https://docs.djangoproject.com/en/4.0/releases/3.2/


Test procedure: https://bugs.mageia.org/show_bug.cgi?id=29737#c3
Comment 8 Len Lawrence 2022-03-20 17:45:36 CET
mga8, x64
Updated the packages using qarepo.
Ran Herman's tests:

$ django-admin startproject mysite
/usr/bin/django-admin:17: RemovedInDjango40Warning: django-admin.py is deprecated in favor of django-admin.
$ tree mysite
mysite
├── manage.py
└── mysite
    ├── asgi.py
    ├── __init__.py
    ├── settings.py
    ├── urls.py
    └── wsgi.py
$ cd mysite
$ python manage.py migrate
Operations to perform:
  Apply all migrations: admin, auth, contenttypes, sessions
Running migrations:
  Applying contenttypes.0001_initial... OK
  Applying auth.0001_initial... OK
[...]
  Applying sessions.0001_initial... OK
$ ls
db.sqlite3  manage.py*  mysite/
$ python manage.py runserver
Watching for file changes with StatReloader
Performing system checks...

System check identified no issues (0 silenced).
March 20, 2022 - 16:26:47
Django version 3.2.12, using settings 'mysite.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.

localhost:8000/ showed django and the rocketship with the Congratulations message.  The three links at the bottom of the page worked OK.

In another teminal:
$ cd mysite
$ python manage.py startapp polls
$ ls polls
admin.py  apps.py  __init__.py  migrations/  models.py  tests.py  views.py
$ cd polls
__init__.py is empty and the other five scripts are just stubs and when run import modules without error.  

That all looks OK.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Comment 9 Thomas Andrews 2022-03-21 13:18:32 CET
Validating. Updated advisory in Comment 7.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-03-21 19:23:49 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 10 Mageia Robot 2022-03-21 21:19:46 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0104.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.