[USN-2062-1] OpenStack Horizon vulnerability

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCgAGBQJSs6yFAAoJEFHb3FjMVZVzETwP/ifGM1r5R+gcrha8JsCxvXb6
xSpRndem++4S2/KplzUP1vGubyFeb7lbWDor816Vut3pPgF21nJN40LV7M+LKA9F
S1nRxc1J/PVaIu8dxSsqshXUgHC0mFS5ChX2zXAo11M8bzZAPMUA34ZAkKjwFIod
AGrZvGzny5wYGLxp9cAjx62W6KMv97SjkjG3+U+aAhxquG5OyiW9yCngT7rAEqor
o4j0Tz+++bhca+mrX5D+Ou/ZLPzsOozRR1xgSAH7/G+3a1vxQl5yB+Zwy2XxYgEq
W65o9lE8mKjFMAOHvOUGOTSDtbyUCySYUHlh0R4s4R2AbJwgzxBuUd375KjvSawh
+zx0HZQXe0N4ClLQzgs+cUnEjQQhxKAJDy7ZwOTn6NZ/uge6Q/UtJ0axWG9l0RQe
miAlULuhDUfL1nzFm7cf5MTCluq4ThBs0lPsbgluhuMCHzPC/64myi9ixcXfahlV
MlgzftWiB5KNypt0rOnp3u2tdThx6s7/OLG8oVQN4DoMXIBobdRoMSab4nWTwssq
1fh2dErcF+JikMt7niicaBSJhECTSWw1iyqwEG4vE+f0bCkirgbACKIWbw2tsh/i
74+/neMe3N4VKN0DJFICTiAtqvMWgtSUthdlHulqqMoe/IDiYSAx42VW5YPPiVpu
MVWxQ6byIuDNWBxl0HYb
=LX3I
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2062-1
December 20, 2013

horizon vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10

Summary:

Horizon could be made to expose sensitive information over the network.

Software Description:
- horizon: Web interface for OpenStack cloud infrastructure

Details:

Chris Chapman discovered cross-site scripting (XSS) vulnerabilities
in Horizon via the Volumes and Network Topology pages. An authenticated
attacker could exploit these to conduct stored cross-site scripting (XSS)
attacks against users viewing these pages in order to modify the contents
or steal confidential data within the same domain.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
python-django-horizon 1:2013.2-0ubuntu1.1

Ubuntu 13.04:
python-django-horizon 1:2013.1.4-0ubuntu1.1

Ubuntu 12.10:
python-django-horizon 2012.2.4-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2062-1
CVE-2013-6858

Package Information:
https://launchpad.net/ubuntu/+source/horizon/1:2013.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/horizon/1:2013.1.4-0ubuntu1.1
https://launchpad.net/ubuntu/+source/horizon/2012.2.4-0ubuntu1.1