SB2020050101 - Gentoo update for Django
Published: May 1, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2019-12308)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of URL within the AdminURLFieldWidget. A remote attacker can trick the victim to follow a specially crafted link and display a clickable JavaScript link.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Resource management error (CVE-ID: CVE-2019-14232)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to usage of truncatechars_html and truncatewords_html template filters in django.utils.text.Truncator during evaluation of HTML content. A remote attacker can pass large content in HTML format to the application and trigger resource exhaustion.
3) Resource management error (CVE-ID: CVE-2019-14233)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to usage of django.utils.html.strip_tags() during evaluation of HTML content. A remote attacker can pass large content in HTML format to the application and trigger resource exhaustion.
4) SQL injection (CVE-ID: CVE-2019-14234)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in django.contrib.postgres.fields.JSONField and django.contrib.postgres.fields.HStoreField. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
5) Resource management error (CVE-ID: CVE-2019-14235)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error when parsing URF-8 data with django.utils.encoding.uri_to_iri(). A remote attacker can pass specially crafted content to the application and consume all available memory on the system.
6) Improper Privilege Management (CVE-ID: CVE-2019-19118)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to incorrect privilege management when processing the save() method in "/django/contrib/admin/options.py". A remote authenticated user can assign elevated privileges to his or her account by manipulating form elements.
7) Input validation error (CVE-ID: CVE-2019-19844)
The vulnerability allows a remote attacker to hijack another user account.
The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.
8) SQL injection (CVE-ID: CVE-2020-7471)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
9) SQL injection (CVE-ID: CVE-2020-9402)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Remediation
Install update from vendor's website.