URGENT: Upgrade Django if Deployed via FastCGI

December 11, 2006

I found a serious vulnerability within the Django implementation of Flup and reported it to the security team. As of r4170 this problem has been fixed.

In my case, my MySQL instance wasn’t responding so MySQLdb threw an exception which was caught by Flup. The traceback, including my database username and password, was displayed in the browser window. This happened because Flup is in debug mode by default; The change mentioned above sets debug to false.


Add your comment

No HTML; Only URLs and line breaks are converted.