|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2021-46898: python-django-grappelli: views/switch.py vulnerable to protocol-relative URL attacks | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Distribution | Reporter: | SMASH SMASH <smash_bz> |
| Component: | Security | Assignee: | Security Team bot <security-team> |
| Status: | NEW --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | gabriele.sonnu |
| Version: | Leap 15.6 | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/382710/ | ||
| Whiteboard: | |||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
This only affects version < 2.15.2. Factory is on 3.0.7 so not affected. Backports are on 2.14.2, so tracking them as affected: - openSUSE:Backports:SLE-15-SP4/python-django-grappelli - openSUSE:Backports:SLE-15-SP5/python-django-grappelli Upstream fix: https://github.com/sehmaschine/django-grappelli/pull/976 submitted This is an autogenerated message for OBS integration: This bug (1216481) was mentioned in https://build.opensuse.org/request/show/1129256 Backports:SLE-15-SP6 / python-django-grappelli https://build.opensuse.org/request/show/1129257 Backports:SLE-15-SP5 / python-django-grappelli https://build.opensuse.org/request/show/1129258 Backports:SLE-15-SP4 / python-django-grappelli openSUSE-SU-2023:0384-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1216481 CVE References: CVE-2021-46898 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): python-django-grappelli-2.14.4-bp154.2.3.1 openSUSE-SU-2024:0017-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1216481 CVE References: CVE-2021-46898 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): python-django-grappelli-2.14.4-bp155.3.3.1 |
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46898