CVE-2011-0696

Publication date 14 February 2011

Last updated 24 July 2024

Ubuntu priority

Description

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-django	11.10 oneiric	Fixed 1.2.5-1ubuntu1
	11.04 natty	Fixed 1.2.5-1ubuntu1
	10.10 maverick	Fixed 1.2.3-1ubuntu0.2.10.10.2
	10.04 LTS lucid	Fixed 1.1.1-2ubuntu1.3
	9.10 karmic	Fixed 1.1.1-1ubuntu1.2
	8.04 LTS hardy	Ignored end of life
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
python-django	Upstream: http://code.djangoproject.com/changeset/15464 Upstream: http://code.djangoproject.com/changeset/15465 Upstream: http://code.djangoproject.com/changeset/15466

References

Related Ubuntu Security Notices (USN)

USN-1066-1
Django vulnerabilities
17 February 2011