FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2016-2512

This CVE name corresponds to:

Entered	Topic
2016-03-08	django -- multiple vulnerabilies

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2016-2512 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2016-2512
Phase	Assigned(20160219)

Description

The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.

References

Source	Reference
CONFIRM	https://github.com/django/django/commit/c5544d289233f501917e25970c03ed444abbd4f0
CONFIRM	https://www.djangoproject.com/weblog/2016/mar/01/security-releases/
REDHAT	RHSA-2016:0504