kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Document Django multiple vulnerabilities

Browse source 
Security:	CVE-2016-2512
Security:	CVE-2016-2513
Security:	https://vuxml.FreeBSD.org/freebsd/f9e6c0d1-e4cc-11e5-b2bd-002590263bf5.html
This commit is contained in:
Jason Unovitch 2016-03-08 01:45:27 +00:00
parent 3cb3587b06
commit 8d10903695
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=410598
1 changed files with 58 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
security/vuxml/vuln.xml
View file

@ -58,6 +58,64 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="f9e6c0d1-e4cc-11e5-b2bd-002590263bf5">
<topic>django -- multiple vulnerabilies</topic>
<affects>
<package>
<name>py27-django</name>
<name>py32-django</name>
<name>py33-django</name>
<name>py34-django</name>
<name>py35-django</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django18</name>
<name>py32-django18</name>
<name>py33-django18</name>
<name>py34-django18</name>
<name>py35-django18</name>
<range><lt>1.8.10</lt></range>
</package>
<package>
<name>py27-django19</name>
<name>py32-django19</name>
<name>py33-django19</name>
<name>py34-django19</name>
<name>py35-django19</name>
<range><lt>1.9.3</lt></range>
</package>
<package>
<name>py27-django-devel</name>
<name>py32-django-devel</name>
<name>py33-django-devel</name>
<name>py34-django-devel</name>
<name>py35-django-devel</name>
<range><le>20150709,1</le></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tim Graham reports:</p>
<blockquote cite="https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/">
<p>Malicious redirect and possible XSS attack via user-supplied
redirect URLs containing basic auth</p>
<p>User enumeration through timing difference on password hasher work
factor upgrade</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2016-2512</cvename>
<cvename>CVE-2016-2513</cvename>
<url>https://www.djangoproject.com/weblog/2016/mar/01/security-releases/</url>
</references>
<dates>
<discovery>2016-03-01</discovery>
<entry>2016-03-08</entry>
</dates>
</vuln>
<vuln vid="fef03980-e4c6-11e5-b2bd-002590263bf5">
<topic>wordpress -- multiple vulnerabilities</topic>
<affects>