—

PYSEC-2016-14

Quick fix

PYSEC-2016-14 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=1.9.2'

Details

Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 1.9Fixed in: 1.9.2

Fixpip install --upgrade 'django>=1.9.2'

References

http://www.securitytracker.com/id/1034894[WEB]
https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/[ARTICLE]
http://www.securityfocus.com/bid/82329[WEB]
https://github.com/advisories/GHSA-46x4-9jmv-jc8p[ADVISORY]