python-django: CVE-2019-19118

Debian Bug report logs - #946011
python-django: CVE-2019-19118

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: submit@bugs.debian.org

Subject: python-django: CVE-2019-19118

Date: Mon, 02 Dec 2019 21:20:51 +0100

Package: python-django
Version: 1.7.11-1+deb8u7
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for python-django.

CVE-2019-19118[0]:
| Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model
| editing. A Django model admin displaying inline related models, where
| the user has view-only permissions to a parent model but edit
| permissions to the inline model, would be presented with an editing
| UI, allowing POST requests, for updating the inline model. Directly
| editing the view-only parent model was not possible, but the parent
| model's save() method was called, triggering potential side effects,
| and causing pre and post-save signal handlers to be invoked. (To
| resolve this, the Django admin is adjusted to require edit permissions
| on the parent model in order for inline models to be editable.)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-19118
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19118


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #10 received at 946011@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: 946011@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#946011: python-django: CVE-2019-19118

Date: Mon, 02 Dec 2019 21:30:49 +0100

Chris Lamb wrote:

> Package: python-django
> Version: 1.7.11-1+deb8u7
[…]
> CVE-2019-19118[0]:
> | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model
> | editing. A Django model admin displaying inline related models, where
> | the user has view-only permissions to a parent model but edit
> | permissions to the inline model, would be presented with an editing
> | UI, allowing POST requests, for updating the inline model. Directly
> | editing the view-only parent model was not possible, but the parent
> | model's save() method was called, triggering potential side effects,
> | and causing pre and post-save signal handlers to be invoked. (To
> | resolve this, the Django admin is adjusted to require edit permissions
> | on the parent model in order for inline models to be editable.)

Security team, would you like an upload for stable?


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Message #27 received at 946011@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>, 946011@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#946011: python-django: CVE-2019-19118

Date: Mon, 2 Dec 2019 21:54:41 +0100

Hi Chris,

On Mon, Dec 02, 2019 at 09:30:49PM +0100, Chris Lamb wrote:
> Chris Lamb wrote:
> 
> > Package: python-django
> > Version: 1.7.11-1+deb8u7
> […]
> > CVE-2019-19118[0]:
> > | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model
> > | editing. A Django model admin displaying inline related models, where
> > | the user has view-only permissions to a parent model but edit
> > | permissions to the inline model, would be presented with an editing
> > | UI, allowing POST requests, for updating the inline model. Directly
> > | editing the view-only parent model was not possible, but the parent
> > | model's save() method was called, triggering potential side effects,
> > | and causing pre and post-save signal handlers to be invoked. (To
> > | resolve this, the Django admin is adjusted to require edit permissions
> > | on the parent model in order for inline models to be editable.)
> 
> Security team, would you like an upload for stable?

As far I can see this issue has been introduced around 2.1 where the
surch support for view permissions and a read-only admin support was
added. Before that the issue does not seem to be present and as such
not affecting buster, nor stretch or older.

I have updated this bug with some metadata with that regard. Can you
confirm this assessment?

Regards,
Salvatore

Message #32 received at 946011@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: "Salvatore Bonaccorso" <carnil@debian.org>, 946011@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#946011: python-django: CVE-2019-19118

Date: Tue, 03 Dec 2019 21:25:42 +0100

Dear Salvatore,

> > Security team, would you like an upload for stable?
> 
> As far I can see this issue has been introduced around 2.1 where the
> search support for view permissions and a read-only admin support was
> added.  […]

Upon further inspection that is my reading too. I was being overly-
cautious in assuming that it was vulnerable without doing any checking
first, thus leading to this noise (for which I apologise).

I have updated data/dla-needed.txt and data/CVE/list to match.


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Send a report that this bug log contains spam.