5 ms·
Django security releases issued
- djangouser 14y agowhere can i sign up to receive emails when a new django release is published?
- Tobu 14y agohttps://groups.google.com/group/django-announce/ https://groups.google.com/group/django-announce/ django-announce+subscribe@googlegroups.com
- djangouser 14y agosubscribed. thank you
- gojomo 14y agoI din't yet understand the risk from the 'Host' header issue. In order to modify this header for a user's traffic, wouldn't an attacker already be in control of the user's browser or (unsecured) network path to the server? And thus, would have even easier ways to display arbitrary malicious URLs/content? Or is the mention of password resets an indicator that an attacker, in their own separate connection, can contaminate an email sent to other users with bad URLs? (If so, detecting suspicious Host values would seem to leave a risk that legal-looking but wrong Host values are still trusted by the email mechanism.)
- nbpoole 14y agoI have no Django experience, but I can imagine how an attack like this works: 1. Links are rendered via some function that takes into account the user's current request (ie: to determine the proper host) 2. The "reset your password by clicking this link" URL is generated using that function. 3. I am a malicious attacker and I submit a password reset request for your account. Thus, I can control the URL that is sent to you in an email.
- jacobian 14y agoYup, that's basically it. It essentially makes phishing Django sites easier. The vulnerability could allow an attacker to send a legit email -- sent by the real site itself -- with a link that sends a user to a malicious site instead. [So please upgrade!]
- gojomo 14y agoThe fix as described seems to just check the Host header for suspiciously-formatted information. Is that also enough to prevent other wrong (but well-formatted) Host values from being used? It seems to me that the deeper risk is composing emails based on a passed Host value, rather than any sort of canonical name the site has for itself. Does the warning about avoiding domain-wildcard setups mean this is still a risk, even after the latest fix?
- jacobian 14y ago> The fix as described seems to just check the Host header for suspiciously-formatted information. Is that also enough to prevent other wrong (but well-formatted) Host values from being used? No, it's not. As the release notes say, "Some attacks against this are beyond Django's ability to control, and require the web server to be properly configured"; see https://docs.djangoproject.com/en/1.4/topics/security/#host-headers-and-virtual-hosting https://docs.djangoproject.com/en/1.4/topics/security/#host-... for details.
- gojomo 14y agoThanks for the clarification. The note about "beyond Django's ability to control" seems hand-wavey to me. Avoiding the use of the Host header to construct URLs -- not necessarily as a quick fix, but as a long-term better-practices goal -- would put safety against such attacks completely under Django's control, and provide a bit more defense-in-depth.
- eli 14y ago
- deleted 14y ago[deleted]