Security releases issued
djangoproject.com
djangoproject.com
Ah yes, the billion laughs.
There is no good reason that core XML handling in frameworks should be dealing with dynamically defined entities at all.
Yes, the gem that's extracted could also be checked over for things like the processing of external entities. I'm not familiar with that part of the code, so I can't tell you what it does or does not do.
I am familiar with what it looked like a month or so ago.
Ahh, this may be the difference, sorry. I don't think that it's a reasonable step towards handling XML securely. I _do_ think it's a step towards not exposing people who don't use XML to attacks on their site via XML-parsing code paths.
One of the worst parts of the recent security... situation was that people who didn't even support YAML or XML for their API were still vulnerable. It's these people this helps, not people who actually do use XML.
I totally agree that this isn't useful to people who are actually using XML, except for my comments about quicker releases and fixes by detaching it from Rails.
For example, ActiveResource[1]. Now that it's a gem, the people who use its features can actually take over the maintenance, and release versions independently from Rails proper. It's gotten a lot more contributions lately now that it's independent.
:/ I'm sorry you feel that way. I can only speak for myself, but I certainly don't want to bury any security issues, I want to fix them.
> what is properly considered a piece of core functionality for Rails.
Maybe automatically parsing XML parameters shouldn't be?
If you live in a glass house, don't go around throwing stones.
They're a great group of people and I've got nothing but good things to say about our work together.
Yet another reason why open source is fantastic: friendly competition can actually be friendly. It rocks.
Django folks I've worked with were extremely smart, helpful, and kind. Likewise I only have great things to say.
<3<3<3<3<3<3
Assume you're not talking about DDoS, how?
Nice to see lots of back porting of the security fixes.
[1]: http://stackoverflow.com/questions/514371/whats-the-bad-magi...
Apologies for the shameless plug but at BundleScout we've been working on a tool to notify you when things like this happen[1]. It's not perfect, but it's a step up from this I'd hope.
Your tool seems interesting, i like the idea of being able to keep a list of all the software i use in a single place and get notified when a new update comes out(had a similar idea myself), however i would need some kind of reassurance that such an application is reliable and wont let me in the dark for some important update.
And while, yes, you can watch the RSS feed or Google group, do you really want to do that for Django and the other 29 libraries you use?
A bit off topic but i have some thoughts on the website since i might be interested to using it in the future: It would be great if you could lower the 'within 24 hours' to something like 'within 2 hours'. I understand the difficulty of that since you are tracking over 100.000 packages according to the homepage but a 24 hours dilation is a bit too much, i don't deploy code yet in any high traffic sites which could be subject to a 0day security attack but still i find the dilation too much to consider it as a viable option for the future.
* Post security release announcements to our blog.
* Post announcements to django-announce, a very low-traffic mailing list specifically for security announcements.
* Post announcements to django-users, a mailing list with over 20,000 subscribers from all over the Django community.
* Post announcements to django-developers, where most of the people who hack on Django hang out.
* Publicize these releases on Twitter, Reddit, HN, etc.
Further, we work with people who re-distribute Django (e.g. as part of RHEL/Fedora/Ubuntu/etc.) and people who use Django in high-risk areas to get them early access to security notifications [1].
So yeah, we make a lot of noise about security issues.
BundleScout looks nice, but it kinda sucks that you'd make people pay to hear about security issues. We're going to continue to do our best to make sure people find out about them quickly and for free.
[1] https://docs.djangoproject.com/en/dev/internals/security/#re...
Second, I think the severity of XML external entity injection is understated in the advisory. This class of vulnerability isn't just a DoS in general. Does something about Django specifically limit the impact to just a DoS?
That said, if you're parsing XML in your own code you should be looking at defusedxml, also announced today: http://blog.python.org/2013/02/announcing-defusedxml-fixes-f.... So maybe we should make a bigger point about that? If you've got suggested edits to the announcement let me know, happy to incorporate 'em.
On some Windows systems, you can use a UNC path (\\share) and force the parser to try and connect to a share that the attacker controls, which will cause windows to hand over the user's hash during the handshake.
- DoS
- Disclosing of sensitive files (in general, the XML has to "validate". In PHP, it's always possible to read any file accessible by the process parsing the XML).
- Making arbitrary network connections (with this an attacker can portscan a network, attack vulnerable services that would be protected by firewall, and/or use the vulnerable server as a restricted kind of proxy).
- Probing LDAP directories.
- Remote code execution.
See, for instance:
http://media.blackhat.com/bh-us-12/Briefings/Polyakov/BH_US_...
http://defcon.org.ua/data/2/2_Vorontsov_XXE.pdf
http://www.insinuator.net/2013/01/rails-yaml/
Edit: As a clarification, I'm not implying that any of the above (apart from the DoS issue) is applicable to Django. I'm just saying what can possibly happen (and often happens for PHP apps).
I'm working on updates to the release announcement and release notes for 1.3.6 and 1.4.4 to make this clearer.
The Django project does a fantastic job with announcements. (So does Rails.) And if every open source project had the infrastructure to make that much noise, the world would be a better place. But of the 100k or so Python/Ruby/NPM projects I know about, only a small handful do, or could even manage it.
And if they did, would you want to be on every one of their mailing lists?
Bleach, for example, has more users than I have twitter followers, so I doubt most of them heard about v1.2.1. (Out today! Go get it!)
> but it kinda sucks that you'd make people pay to hear about security issues
Well, like you said, there are other ways to hear about updates, at least from the big projects. This is the convenience of not needing to join dozens of mailing lists and/or check dozens of websites periodically.
I see a real value in a service to let me know that there's a new version of one of the dozens of things I depend on. But like I said, it seems janky to rely on a for-pay service to find out about security vulnerabilities. So what about making the security notification free to all users, with the non-security update notifications a for-pay addon? Seems like a good way to strike a balance between developing a self-sustaining business and helping out a community.
If you don't mind, we'd love to get your thoughts more via email--don't want to hijack this thread too much.
Sidenote: This is one reason why I avoid virtualenv and its ilk for my apps unless I absolutely have to use them (e.g. need a newer version of something to get a feature I can't live without) -- I don't toss aside the good work of vigilant security pros lightly.
From a quick skim of the 4 fixes, perhaps not all Django sites may be at risk. For example, if they are: already checking the 'Host' header or not using it; not using Formsets; not using multiple tiers of admin users; not using Django's XML (de-)serialization.
But, I'm least confident of that last one. Do all Django installs use Django's XML deserialization for something internal/everpresent? Or is this just a risk for users whose apps explicitly do extra XML operations?
If you don't trust your admins, the fourth issue is very important, but lots of places put complete trust in them.
The first issue is more about not becoming a vector for a phishing attack, AIUI.
... but seriously, please do upgrade as soon as possible! There's really no such thing as a "minor" security issue when it's 2am and you're being woken 'cause the site's down.