FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
05dc6efa-2370-11e3-95b7-00e0814cab4edjango -- denial-of-service via large passwords

The Django project reports:

These releases address a denial-of-service attack against Django's authentication framework. All users of Django are encouraged to upgrade immediately.


Discovery 2013-09-15
Entry 2013-09-22
Modified 2014-04-30
py26-django
ge 1.5 lt 1.5.4

ge 1.4 lt 1.4.8

py27-django
ge 1.5 lt 1.5.4

ge 1.4 lt 1.4.8

py26-django-devel
< 20130922,1

py27-django-devel
< 20130922,1

CVE-2013-1443
https://www.djangoproject.com/weblog/2013/sep/15/security/
11c52bc6-97aa-11e5-b8df-14dae9d210b8django -- information leak vulnerability

Tim Graham reports:

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".


Discovery 2015-11-24
Entry 2015-11-30
Modified 2015-12-24
py27-django
py32-django
py33-django
py34-django
< 1.8.7

py27-django18
py32-django18
py33-django18
py34-django18
< 1.8.7

py27-django17
py32-django17
py33-django17
py34-django17
< 1.7.11

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
CVE-2015-8213
14a37474-1383-11e0-8a58-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.

Information leakage in Django administrative interface

The Django administrative interface, django.contrib.admin supports filtering of displayed lists of objects by fields on the corresponding models, including across database-level relationships. This is implemented by passing lookup arguments in the querystring portion of the URL, and options on the ModelAdmin class allow developers to specify particular fields or relationships which will generate automatic links for filtering.

Denial-of-service attack in password-reset mechanism

Django's bundled authentication framework, django.contrib.auth, offers views which allow users to reset a forgotten password. The reset mechanism involves generating a one-time token composed from the user's ID, the timestamp of the reset request converted to a base36 integer, and a hash derived from the user's current password hash (which will change once the reset is complete, thus invalidating the token).


Discovery 2010-12-22
Entry 2010-12-29
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.4

gt 1.1 lt 1.1.3

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
< 15032,1

45562
45563
https://bugzilla.redhat.com/show_bug.cgi?id=665373
http://secunia.com/advisories/42715/
21c59f5e-7cc5-11e2-9c11-080027a5ec9adjango -- multiple vulnerabilities

The Django Project reports:

These security releases fix four issues: one potential phishing vector, one denial-of-service vector, an information leakage issue, and a range of XML vulnerabilities.

  1. Host header poisoning

    an attacker could cause Django to generate and display URLs that link to arbitrary domains. This could be used as part of a phishing attack. These releases fix this problem by introducing a new setting, ALLOWED_HOSTS, which specifies a whitelist of domains your site is known to respond to.

    Important: by default Django 1.3.6 and 1.4.4 set ALLOWED_HOSTS to allow all hosts. This means that to actually fix the security vulnerability you should define this setting yourself immediately after upgrading.

  2. Formset denial-of-service

    an attacker can abuse Django's tracking of the number of forms in a formset to cause a denial-of-service attack. This has been fixed by adding a default maximum number of forms of 1,000. You can still manually specify a bigger max_num, if you wish, but 1,000 should be enough for anyone.

  3. XML attacks

    Django's serialization framework was vulnerable to attacks via XML entity expansion and external references; this is now fixed. However, if you're parsing arbitrary XML in other parts of your application, we recommend you look into the defusedxml Python packages which remedy this anywhere you parse XML, not just via Django's serialization framework.

  4. Data leakage via admin history log

    Django's admin interface could expose supposedly-hidden information via its history log. This has been fixed.


Discovery 2013-02-21
Entry 2013-02-24
py26-django
py27-django
ge 1.3 lt 1.3.6

ge 1.4 lt 1.4.4

CVE-2013-1664
CVE-2013-1665
CVE-2013-0305
CVE-2013-0306
58022
58061
37ed8e9c-2651-11e5-86ff-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.


Discovery 2015-06-10
Entry 2015-07-09
py27-django
ge 1.4.0 lt 1.4.21

py32-django
ge 1.4.0 lt 1.4.21

py33-django
ge 1.4.0 lt 1.4.21

py34-django
ge 1.4.0 lt 1.4.21

py27-django
ge 1.7.0 lt 1.7.9

py32-django
ge 1.7.0 lt 1.7.9

py33-django
ge 1.7.0 lt 1.7.9

py34-django
ge 1.7.0 lt 1.7.9

py27-django
ge 1.8.0 lt 1.8.3

py32-django
ge 1.8.0 lt 1.8.3

py33-django
ge 1.8.0 lt 1.8.3

py34-django
ge 1.8.0 lt 1.8.3

py27-django-devel
le 20150531,1

py32-django-devel
le 20150531,1

py33-django-devel
le 20150531,1

py34-django-devel
le 20150531,1

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680
https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44
https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e
CVE-2015-5143
CVE-2015-5144
CVE-2015-5145
37ed8e9c-2651-11e5-86ff-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.


Discovery 2015-06-10
Entry 2015-07-09
py27-django
ge 1.4.0 lt 1.4.21

py32-django
ge 1.4.0 lt 1.4.21

py33-django
ge 1.4.0 lt 1.4.21

py34-django
ge 1.4.0 lt 1.4.21

py27-django
ge 1.7.0 lt 1.7.9

py32-django
ge 1.7.0 lt 1.7.9

py33-django
ge 1.7.0 lt 1.7.9

py34-django
ge 1.7.0 lt 1.7.9

py27-django
ge 1.8.0 lt 1.8.3

py32-django
ge 1.8.0 lt 1.8.3

py33-django
ge 1.8.0 lt 1.8.3

py34-django
ge 1.8.0 lt 1.8.3

py27-django-devel
le 20150531,1

py32-django-devel
le 20150531,1

py33-django-devel
le 20150531,1

py34-django-devel
le 20150531,1

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680
https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44
https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e
CVE-2015-5143
CVE-2015-5144
CVE-2015-5145
37ed8e9c-2651-11e5-86ff-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.


Discovery 2015-06-10
Entry 2015-07-09
py27-django
ge 1.4.0 lt 1.4.21

py32-django
ge 1.4.0 lt 1.4.21

py33-django
ge 1.4.0 lt 1.4.21

py34-django
ge 1.4.0 lt 1.4.21

py27-django
ge 1.7.0 lt 1.7.9

py32-django
ge 1.7.0 lt 1.7.9

py33-django
ge 1.7.0 lt 1.7.9

py34-django
ge 1.7.0 lt 1.7.9

py27-django
ge 1.8.0 lt 1.8.3

py32-django
ge 1.8.0 lt 1.8.3

py33-django
ge 1.8.0 lt 1.8.3

py34-django
ge 1.8.0 lt 1.8.3

py27-django-devel
le 20150531,1

py32-django-devel
le 20150531,1

py33-django-devel
le 20150531,1

py34-django-devel
le 20150531,1

https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
https://github.com/django/django/commit/df049ed77a4db67e45db5679bfc76a85d2a26680
https://github.com/django/django/commit/014247ad1922931a2f17beaf6249247298e9dc44
https://github.com/django/django/commit/17d3a6d8044752f482453f5906026eaf12c39e8e
CVE-2015-5143
CVE-2015-5144
CVE-2015-5145
3c5579f7-294a-11e4-99f6-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

These releases address an issue with reverse() generating external URLs; a denial of service involving file uploads; a potential session hijacking issue in the remote-user middleware; and a data leak in the administrative interface. We encourage all users of Django to upgrade as soon as possible.


Discovery 2014-08-20
Entry 2014-08-21
py27-django
ge 1.6 lt 1.6.6

py27-django15
ge 1.5 lt 1.5.9

py27-django14
ge 1.4 lt 1.4.14

py32-django
ge 1.6 lt 1.6.6

py32-django15
ge 1.5 lt 1.5.9

py33-django
ge 1.6 lt 1.6.6

py33-django15
ge 1.5 lt 1.5.9

py34-django
ge 1.6 lt 1.6.6

py34-django15
ge 1.5 lt 1.5.9

py27-django-devel
< 20140821,1

py32-django-devel
< 20140821,1

py33-django-devel
< 20140821,1

py34-django-devel
< 20140821,1

https://www.djangoproject.com/weblog/2014/aug/20/security/
CVE-2014-0480
CVE-2014-0481
CVE-2014-0482
CVE-2014-0483
48504af7-07ad-11e5-879c-00e0814cab4edjango -- Fixed session flushing in the cached_db backend

The Django project reports:

A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in their session cookie will use the same session store. session.flush() is called by django.contrib.auth.logout() and, more seriously, by django.contrib.auth.login() when a user switches accounts. If a user is logged in and logs in again to a different account (without logging out) the session is flushed to avoid reuse. After the session is flushed (and its session key becomes '') the account details are set on the session and the session is saved. Any users with an empty string in their session cookie will now be logged into that account.

Thanks to Sam Cooke for reporting the issue.


Discovery 2015-05-20
Entry 2015-05-31
py27-django
ge 1.8 lt 1.8.2

py32-django
ge 1.8 lt 1.8.2

py33-django
ge 1.8 lt 1.8.2

py34-django
ge 1.8 lt 1.8.2

py27-django-devel
< 20150531,1

py32-django-devel
< 20150531,1

py33-django-devel
< 20150531,1

py34-django-devel
< 20150531,1

https://www.djangoproject.com/weblog/2015/may/20/security-release/
CVE-2015-3982
59e72db2-cae6-11e3-8420-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.


Discovery 2014-04-21
Entry 2014-04-23
Modified 2014-04-30
py26-django
ge 1.6 lt 1.6.3

py27-django
ge 1.6 lt 1.6.3

py31-django
ge 1.6 lt 1.6.3

py32-django
ge 1.6 lt 1.6.3

py33-django
ge 1.6 lt 1.6.3

py34-django
ge 1.6 lt 1.6.3

py26-django15
ge 1.5 lt 1.5.6

py27-django15
ge 1.5 lt 1.5.6

py31-django15
ge 1.5 lt 1.5.6

py32-django15
ge 1.5 lt 1.5.6

py33-django15
ge 1.5 lt 1.5.6

py34-django15
ge 1.5 lt 1.5.6

py26-django14
ge 1.4 lt 1.4.11

py27-django14
ge 1.4 lt 1.4.11

py31-django14
ge 1.4 lt 1.4.11

py32-django14
ge 1.4 lt 1.4.11

py33-django14
ge 1.4 lt 1.4.11

py34-django14
ge 1.4 lt 1.4.11

py26-django-devel
< 20140423,1

py27-django-devel
< 20140423,1

https://www.djangoproject.com/weblog/2014/apr/21/security/
CVE-2014-0472
CVE-2014-0473
CVE-2014-0474
62287f51-d43d-11e4-879c-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.20, 1.6.11, 1.7.7 and 1.8c1. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.


Discovery 2015-03-18
Entry 2015-03-27
py27-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py32-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py33-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py34-django
ge 1.4 lt 1.4.20

ge 1.6 lt 1.6.11

ge 1.7 lt 1.7.7

py27-django-devel
< 20150326,1

py32-django-devel
< 20150326,1

py33-django-devel
< 20150326,1

py34-django-devel
< 20150326,1

https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
CVE-2015-2316
CVE-2015-2317
9c7b6c20-a324-11e4-879c-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process. These releases are now available on PyPI and our download page.

These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.


Discovery 2015-01-13
Entry 2015-01-23
Modified 2015-01-24
py27-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py32-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py33-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py34-django
ge 1.4 lt 1.4.18

ge 1.5 le 1.5.12

ge 1.6 lt 1.6.10

ge 1.7 lt 1.7.3

py27-django-devel
< 20150124,1

py32-django-devel
< 20150124,1

py33-django-devel
< 20150124,1

py34-django-devel
< 20150124,1

https://www.djangoproject.com/weblog/2015/jan/13/security/
CVE-2015-0219
CVE-2015-0220
CVE-2015-0221
CVE-2015-0222
a851b305-1bc3-11e3-95b7-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

These releases address a directory-traversal vulnerability in one of Django's built-in template tags. While this issue requires some fairly specific factors to be exploitable, we encourage all users of Django to upgrade promptly.


Discovery 2013-09-10
Entry 2013-09-12
Modified 2014-04-30
py26-django
ge 1.5 lt 1.5.3

ge 1.4 lt 1.4.7

py27-django
ge 1.5 lt 1.5.3

ge 1.4 lt 1.4.7

py26-django-devel
< 20130912,1

py27-django-devel
< 20130912,1

CVE-2013-4315
https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/
b0e54dc1-45d2-11e5-adde-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.


Discovery 2015-08-18
Entry 2015-08-18
py27-django
py32-django
py33-django
py34-django
< 1.8.4

py27-django17
py32-django17
py33-django17
py34-django17
< 1.7.10

py27-django14
py32-django14
py33-django14
py34-django14
< 1.4.22

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
CVE-2015-5963
CVE-2015-5964
bd760627-3493-11e0-8103-00215c6a37bbdjango -- multiple vulnerabilities

Django project reports:

Today the Django team is issuing multiple releases -- Django 1.2.5 and Django 1.1.4 -- to remedy three security issues reported to us. All users of affected versions of Django are urged to upgrade immediately.


Discovery 2011-02-08
Entry 2011-02-09
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
gt 1.2 lt 1.2.5

gt 1.1 lt 1.1.4

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
< 15470,1

http://www.djangoproject.com/weblog/2011/feb/08/security/
cb116651-79db-4c09-93a2-c38f9df46724django -- multiple vulnerabilities

The Django project reports:

Today the Django team released Django 1.10.3, Django 1.9.11, and 1.8.16. These releases addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

  • User with hardcoded password created when running tests on Oracle
  • DNS rebinding vulnerability when DEBUG=True

Discovery 2016-11-01
Entry 2016-11-02
py27-django
py33-django
py34-django
py35-django
< 1.8.16

py27-django18
py33-django18
py34-django18
py35-django18
< 1.8.16

py27-django19
py33-django19
py34-django19
py35-django19
< 1.9.11

py27-django110
py33-django110
py34-django110
py35-django110
< 1.10.3

https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
CVE-2016-9013
CVE-2016-9014
d01d10c7-de2d-11e0-b215-00215c6a37bbdjango -- multiple vulnerabilities

The Django project reports:

Please reference CVE/URL list for details


Discovery 2011-09-09
Entry 2011-09-13
Modified 2011-11-01
py23-django
py24-django
py25-django
py26-django
py27-django
py30-django
py31-django
ge 1.3 lt 1.3.1

ge 1.2 lt 1.2.7

py23-django-devel
py24-django-devel
py25-django-devel
py26-django-devel
py27-django-devel
py30-django-devel
py31-django-devel
< 16758,1

https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/
dc880d6c-195d-11e7-8c63-0800277dcc69django -- multiple vulnerabilities

Django team reports:

These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

  • Open redirect and possible XSS attack via user-supplied numeric redirect URLs
  • Open redirect vulnerability in django.views.static.serve()

Discovery 2017-04-04
Entry 2017-04-04
py27-django
py33-django
py34-django
py35-django
py36-django
< 1.8.18

py27-django18
py33-django18
py34-django18
py35-django18
py36-django18
< 1.8.18

py27-django19
py33-django19
py34-django19
py35-django19
py36-django19
< 1.9.13

py27-django110
py33-django110
py34-django110
py35-django110
py36-django110
< 1.10.7

https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
CVE-2017-7233
CVE-2017-7234
f01292a0-db3c-11e1-a84b-00e0814cab4edjango -- multiple vulnerabilities

The Django project reports:

Today the Django team is issuing multiple releases -- Django 1.3.2 and Django 1.4.1 -- to remedy security issues reported to us:

  • Cross-site scripting in authentication views
  • Denial-of-service in image validation
  • Denial-of-service via get_image_dimensions()

All users are encouraged to upgrade Django immediately.


Discovery 2012-07-30
Entry 2012-07-31
Modified 2014-04-30
py26-django
ge 1.4 lt 1.4.1

ge 1.3 lt 1.3.2

py27-django
ge 1.4 lt 1.4.1

ge 1.3 lt 1.3.2

py26-django-devel
< 20120731,1

py27-django-devel
< 20120731,1

CVE-2012-3442
CVE-2012-3443
CVE-2012-3444
https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/
f9e6c0d1-e4cc-11e5-b2bd-002590263bf5django -- multiple vulnerabilities

Tim Graham reports:

Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

User enumeration through timing difference on password hasher work factor upgrade


Discovery 2016-03-01
Entry 2016-03-08
py27-django
py32-django
py33-django
py34-django
py35-django
< 1.8.10

py27-django18
py32-django18
py33-django18
py34-django18
py35-django18
< 1.8.10

py27-django19
py32-django19
py33-django19
py34-django19
py35-django19
< 1.9.3

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
py35-django-devel
le 20150709,1

CVE-2016-2512
CVE-2016-2513
https://www.djangoproject.com/weblog/2016/mar/01/security-releases/