*** This bug is a security vulnerability ***
Public security bug reported:
"Django's template language includes two methods of including and
rendering one template inside another:
The {% include %} tag takes a template name, and uses Django's template loading
mechanism (which is restricted to the directories specified in the
TEMPLATE_DIRS setting, as with any other normal template load in Django).
The {% ssi %} tag, which takes a file path and includes that file's contents
(optionally parsing and rendering it as a template).
Since the ssi tag is not restricted to TEMPLATE_DIRS, it represents a
security risk; the setting ALLOWED_INCLUDE_ROOTS thus is required, and
specifies filesystem locations from which ssi may read files."
https://www.djangoproject.com/weblog/2013/sep/10/security-releases-
issued/
** Affects: python-django (Ubuntu)
Importance: Undecided
Status: New
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to python-django in Ubuntu.
https://bugs.launchpad.net/bugs/1227518
Title:
CVE-2013-4315: Directory traversal with ssi template tag
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-django/+bug/1227518/+subscriptions
--
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
