PT-2007-1875 · Django · Django

Published 2007-01-23 · Updated 2022-05-01 · CVE-2007-0404

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Django version 0.95

Description The issue arises from the bin/compile-messages.py script in Django, which fails to properly quote argument strings before invoking the msgfmt program through the os.system function. This oversight allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

Recommendations For Django version 0.95, consider modifying the bin/compile-messages.py script to properly quote argument strings before invoking the msgfmt program to prevent command execution via shell metacharacters. As a temporary workaround, restrict access to the bin/compile-messages.py script and avoid using it with untrusted .po or .mo files until a proper fix is applied.

Fix

Related Identifiers

CVE-2007-0404

GHSA-QC99-G3WM-HGXR

Affected Products

Django

References · 13

• http://secunia.com/advisories/23826 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0404 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-0404 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-0404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0404 · Security Note
• https://osv.dev/vulnerability/GHSA-qc99-g3wm-hgxr · Vendor Advisory
• https://github.com/django/django · Note
• https://github.com/django/django/commit/a132d411c6986418ee6c0edc331080aa792fee6e · Note
• https://github.com/django/django/commit/518d406e53 · Note
• http://securityfocus.com/bid/22134 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407519 · Note
• http://code.djangoproject.com/changeset/3592 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31627 · Note