Vulnerability CVE-2017-7233: Information

Description

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-7233
Published: April 4, 2017
Modified: Oct. 17, 2018
Error type identifier: CWE-601

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
python-module-djangop91.8.18-alt11.11.29-alt2ALT-PU-2017-1458-1181646Fixed
python-module-djangop81.8.18-alt0.M80P.11.8.18-alt0.M80P.1ALT-PU-2017-1760-1184483Fixed
python-module-djangoc9f21.8.18-alt11.11.23-alt1ALT-PU-2017-1458-1181646Fixed
python-module-djangoc71.8.18-alt0.M70C.11.8.18-alt0.M70C.1ALT-PU-2017-1754-1184484Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.djangoproject.com/weblog/2017/apr/04/security-releases/
  • Vendor Advisory
97406
  • Third Party Advisory
  • VDB Entry
1038177
    DSA-3835
      RHSA-2017:3093
        RHSA-2017:1596
          RHSA-2017:1470
            RHSA-2017:1462
              RHSA-2017:1451
                RHSA-2017:1445
                  RHSA-2018:2927

                      1. Configuration 1

                        cpe:2.3:a:djangoproject:django:1.10.0:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9:a1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.0:a1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.15:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.6:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9:rc2:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.3:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.14:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.9:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.0:b1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.1:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.7:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.9:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.5:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.5:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.11:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.0:a1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.12:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.12:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.11:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.2:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.16:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.3:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.4:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.0:c1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.6:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.13:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.0:b1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.0:rc1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.7:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.17:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.8:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.1:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.10.4:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.8:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.0:b2:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.2:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9:b1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9.10:*:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.9:rc1:*:*:*:*:*:*
                        cpe:2.3:a:djangoproject:django:1.8.10:*:*:*:*:*:*:*
                    VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                    Version: v24.5.3
                    Back to top