RHSA-2016:1596 - Security Advisory

주제

An update for python-django is now available for Red Hat OpenStack Platform 8.0 (Liberty).

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

설명

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself) principle.

Security Fix(es):

• A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related popup. Element.textContent is now used to prevent XSS data execution. (CVE-2016-6186)

Red Hat would like to thank the upstream Django project for reporting this issue.

솔루션

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

영향을 받는 제품

• Red Hat OpenStack 8 x86_64

수정

• BZ - 1355663 - CVE-2016-6186 django: XSS in admin's add/change related popup

CVE

• CVE-2016-6186

참조

• http://www.redhat.com/security/updates/classification/#normal