The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.

Simon Willison discovered that in Django, a Python web framework, the feature to retain HTTP POST data during user reauthentication allowed a remote attacker to perform unauthorized modification of data through cross site request forgery. This is possible regardless of the Django plugin to prevent cross site request forgery being enabled. The Common Vulnerabilities and Exposures project identifies this issue as CVE-2008-3909.

In this update the affected feature is disabled; this is in accordance with upstream's preferred solution for this situation.

This update takes the opportunity to also include a relatively minor denial of service attack in the internationalisation framework, known as CVE-2007-5712.

- Thu Nov 1 2007 Michel Salim <michel.sylvan at gmail.com>     0.96.1-1

    - i18n security update: CVE-2007-5712, bz#357051

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #362771 - CVE-2007-5712 Django 0.96 i18n DoS [F8]

  - Bug #357051 - CVE-2007-5712 Django 0.96 i18n DoS

  - CVE-2007-5712

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
34253	Debian DSA-1640-1 : python-django - several vulnerabilities	Nessus	Debian Local Security Checks	medium
28164	Fedora 7 : Django-0.96.1-1.fc7 (2007-3157)	Nessus	Fedora Local Security Checks	low
28152	Fedora 8 : Django-0.96.1-1.fc8 (2007-2788)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2007-5712

low

Tenable Plugins

medium

low

low