| Description: | Summary:
The remote host is missing an update for the 'python-django'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple vulnerabilities has been found and corrected in python-django:
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly
validate HTTP requests that contain an X-Requested-With header,
which makes it easier for remote attackers to conduct cross-site
request forgery (CSRF) attacks via forged AJAX requests that leverage
a combination of browser plugins and redirects, a related issue to
CVE-2011-0447 (CVE-2011-0696).
Cross-site scripting (XSS) vulnerability in Django 1.1.x before
1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject
arbitrary web script or HTML via a filename associated with a file
upload (CVE-2011-0697).
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and
1.2.x before 1.2.5 on Windows might allow remote attackers to read or
execute files via a / (slash) character in a key in a session cookie,
related to session replays (CVE-2011-0698).
The updated packages have been upgraded to the 1.1.4 version which
is not vulnerable to these issues.
Affected Software/OS:
python-django on Mandriva Linux 2010.0,
Mandriva Linux 2010.0/X86_64,
Mandriva Linux 2010.1,
Mandriva Linux 2010.1/X86_64
Solution:
Please Install the Updated Packages.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
