URGENT: Upgrade Django if Deployed via FastCGI
December 11, 2006
I found a serious vulnerability within the Django implementation of Flup and reported it to the security team. As of r4170 this problem has been fixed.
In my case, my MySQL instance wasn’t responding so MySQLdb threw an exception which was caught by Flup. The traceback, including my database username and password, was displayed in the browser window. This happened because Flup is in debug mode by default; The change mentioned above sets debug to false.
Add your comment
No HTML; Only URLs and line breaks are converted.