Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-2316 (GCVE-0-2015-2316)
Vulnerability from cvelistv5
Published
2015-03-25 14:00
Modified
2024-08-06 05:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:10:16.424Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-2539-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"name": "73322",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/73322"
},
{
"name": "FEDORA-2015-5766",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "openSUSE-SU-2015:0643",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-03-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-30T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-2539-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"name": "73322",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/73322"
},
{
"name": "FEDORA-2015-5766",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "openSUSE-SU-2015:0643",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-2539-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"name": "73322",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/73322"
},
{
"name": "FEDORA-2015-5766",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "openSUSE-SU-2015:0643",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"name": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/",
"refsource": "CONFIRM",
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2316",
"datePublished": "2015-03-25T14:00:00",
"dateReserved": "2015-03-17T00:00:00",
"dateUpdated": "2024-08-06T05:10:16.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2015-2316\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-03-25T14:59:02.940\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n utils.html.strip_tags en Django 1.6.x anterior a 1.6.11, 1.7.x anterior a 1.7.7, y 1.8.x anterior a 1.8c1, cuando utiliza ciertos versiones de Python, permite a atacantes remotos causar una denegaci\u00f3n de servicio (bucle infinito) mediante el incremento de la longitud de la cadena de entradas.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-399\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B1C288F-326B-497B-B26C-D26E01262DDB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"29477EEA-D5F8-45A9-9777-8A6BC7C668A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A83451BD-1D67-4A7F-A62C-F597E51FCC21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0300DC0D-5DD0-42B5-9FE0-54DC557EA40D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"85A2021F-B2AF-40DC-9FA2-5F90D2EB813E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B12D68-BB49-4931-9D9E-D8134FC0B350\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CC369A0-0092-450D-91E9-13C7AF7EBC16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B6B7974-ABEF-4E0C-8503-6E9C22D28C78\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55460F1D-661B-465C-8A22-E4E6DA2834B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FD4FB46-3A98-4B9B-A241-C39E2C2A0FEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF87FDAB-51A2-41C4-A4C4-5180B0230C3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80E8431B-FEA1-4D94-B367-56E8678C3CD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81E7779A-EDB9-4871-8D7C-63C5A7C7A0DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ABB56113-5E66-4EE9-B551-FD40C2FE307B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2985241-279F-46AC-8BBF-DF2F439FE720\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.6.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6D0F178-D3DE-4E1D-B666-B40262CDF9BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB1EF6D7-0AF4-4146-BA37-961F7048C1C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E4CCE84-425C-4B9C-98B7-D858B64B3418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6B77FCE-F26A-41CB-8D72-E9EF0E352288\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"985884FE-AEB9-4D93-806E-ADFCC576FF99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D81EE1B4-9CB4-4776-A7CE-44B023C67CA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"81798B3D-A000-40D5-A369-C9A0BEF79A5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"32DDDBEB-6F2F-4BA9-876D-38D41BA29726\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06513AE1-11E4-4A9C-BDA4-D0511A9DCFC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6004EA17-A2B4-4E4C-A738-210FCAC2CA32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61680046-51CD-4217-AC1E-C11265205DB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4320AE65-B4A7-4CC3-8BE0-6CD4FFBC24C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18E5B08A-E6FC-440C-A2F8-1D8B727D55E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DAD077F-A239-4021-890E-AD4D9D9A388D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02D3C0FF-C342-40F1-A187-CD212C16FE8F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"5D37DF0F-F863-45AC-853A-3E04F9FEC7CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49A63F39-30BE-443F-AF10-6245587D3359\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"253C303A-E577-4488-93E6-68A8DD942C38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03117DF1-3BEC-4B8D-AD63-DBBDB2126081\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/73322\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2539-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.djangoproject.com/weblog/2015/mar/18/security-releases/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/73322\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2539-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.djangoproject.com/weblog/2015/mar/18/security-releases/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
ghsa-j3j3-jrfh-cm2w
Vulnerability from github
Published
2022-05-14 02:06
Modified
2024-09-18 16:03
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
VLAI Severity ?
Summary
Django Denial-of-service possibility with strip_tags
Details
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.6"
},
{
"fixed": "1.6.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.7"
},
{
"fixed": "1.7.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.8a1"
},
{
"fixed": "1.8c1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-2316"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-29T11:21:09Z",
"nvd_published_at": "2015-03-25T14:59:00Z",
"severity": "HIGH"
},
"details": "The `utils.html.strip_tags` function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"id": "GHSA-j3j3-jrfh-cm2w",
"modified": "2024-09-18T16:03:03Z",
"published": "2022-05-14T02:06:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2316"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229033201/http://www.securityfocus.com/bid/73322"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2539-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django Denial-of-service possibility with strip_tags"
}
suse-su-2015:0695-1
Vulnerability from csaf_suse
Published
2014-09-03 15:51
Modified
2014-09-03 15:51
Summary
Security update for python-django
Notes
Title of the patch
Security update for python-django
Description of the patch
python-django was updated to 1.5.10 fixing bugs and security issues:
* Prevented reverse() from generating URLs pointing to other hosts to
prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
manipulation. (bnc#893090, CVE-2014-0483)
Security Issues:
* CVE-2014-0480
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Patchnames
sleclo40sp3-python-django
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n * Prevented reverse() from generating URLs pointing to other hosts to\n prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n * Removed O(n) algorithm when uploading duplicate file names to fix\n file upload denial of service. (bnc#893088, CVE-2014-0481)\n * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n prevent session hijacking. (bnc#893089, CVE-2014-0482)\n * Prevented data leakage in contrib.admin via query string\n manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n * CVE-2014-0480\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n * CVE-2014-0481\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n * CVE-2014-0482\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n * CVE-2014-0483\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleclo40sp3-python-django",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0695-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0695-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150695-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0695-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-April/001340.html"
},
{
"category": "self",
"summary": "SUSE Bug 893087",
"url": "https://bugzilla.suse.com/893087"
},
{
"category": "self",
"summary": "SUSE Bug 893088",
"url": "https://bugzilla.suse.com/893088"
},
{
"category": "self",
"summary": "SUSE Bug 893089",
"url": "https://bugzilla.suse.com/893089"
},
{
"category": "self",
"summary": "SUSE Bug 893090",
"url": "https://bugzilla.suse.com/893090"
},
{
"category": "self",
"summary": "SUSE Bug 913053",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "self",
"summary": "SUSE Bug 913054",
"url": "https://bugzilla.suse.com/913054"
},
{
"category": "self",
"summary": "SUSE Bug 913055",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "self",
"summary": "SUSE Bug 913056",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "self",
"summary": "SUSE Bug 914706",
"url": "https://bugzilla.suse.com/914706"
},
{
"category": "self",
"summary": "SUSE Bug 923176",
"url": "https://bugzilla.suse.com/923176"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0480 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0480/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0481 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0481/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0482 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0482/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0483 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0483/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0219 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0219/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0220 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0220/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0221 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0221/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2316 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2317/"
}
],
"title": "Security update for python-django",
"tracking": {
"current_release_date": "2014-09-03T15:51:02Z",
"generator": {
"date": "2014-09-03T15:51:02Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0695-1",
"initial_release_date": "2014-09-03T15:51:02Z",
"revision_history": [
{
"date": "2014-09-03T15:51:02Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-django-1.5.10-0.11.1.x86_64",
"product": {
"name": "python-django-1.5.10-0.11.1.x86_64",
"product_id": "python-django-1.5.10-0.11.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 4",
"product": {
"name": "SUSE OpenStack Cloud 4",
"product_id": "SUSE OpenStack Cloud 4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:cloud:4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-1.5.10-0.11.1.x86_64 as component of SUSE OpenStack Cloud 4",
"product_id": "SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
},
"product_reference": "python-django-1.5.10-0.11.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0480",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0480"
}
],
"notes": [
{
"category": "general",
"text": "The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0480",
"url": "https://www.suse.com/security/cve/CVE-2014-0480"
},
{
"category": "external",
"summary": "SUSE Bug 893087 for CVE-2014-0480",
"url": "https://bugzilla.suse.com/893087"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0480",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0480"
},
{
"cve": "CVE-2014-0481",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0481"
}
],
"notes": [
{
"category": "general",
"text": "The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0481",
"url": "https://www.suse.com/security/cve/CVE-2014-0481"
},
{
"category": "external",
"summary": "SUSE Bug 893088 for CVE-2014-0481",
"url": "https://bugzilla.suse.com/893088"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0481",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0481"
},
{
"cve": "CVE-2014-0482",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0482"
}
],
"notes": [
{
"category": "general",
"text": "The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0482",
"url": "https://www.suse.com/security/cve/CVE-2014-0482"
},
{
"category": "external",
"summary": "SUSE Bug 893089 for CVE-2014-0482",
"url": "https://bugzilla.suse.com/893089"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0482",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0482"
},
{
"cve": "CVE-2014-0483",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0483"
}
],
"notes": [
{
"category": "general",
"text": "The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0483",
"url": "https://www.suse.com/security/cve/CVE-2014-0483"
},
{
"category": "external",
"summary": "SUSE Bug 893090 for CVE-2014-0483",
"url": "https://bugzilla.suse.com/893090"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0483",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "low"
}
],
"title": "CVE-2014-0483"
},
{
"cve": "CVE-2015-0219",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0219"
}
],
"notes": [
{
"category": "general",
"text": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0219",
"url": "https://www.suse.com/security/cve/CVE-2015-0219"
},
{
"category": "external",
"summary": "SUSE Bug 913053 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0219"
},
{
"cve": "CVE-2015-0220",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0220"
}
],
"notes": [
{
"category": "general",
"text": "The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \"\\njavascript:\" URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0220",
"url": "https://www.suse.com/security/cve/CVE-2015-0220"
},
{
"category": "external",
"summary": "SUSE Bug 913054 for CVE-2015-0220",
"url": "https://bugzilla.suse.com/913054"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0220",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0220"
},
{
"cve": "CVE-2015-0221",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0221"
}
],
"notes": [
{
"category": "general",
"text": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0221",
"url": "https://www.suse.com/security/cve/CVE-2015-0221"
},
{
"category": "external",
"summary": "SUSE Bug 913056 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0221"
},
{
"cve": "CVE-2015-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0222"
}
],
"notes": [
{
"category": "general",
"text": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0222",
"url": "https://www.suse.com/security/cve/CVE-2015-0222"
},
{
"category": "external",
"summary": "SUSE Bug 913055 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0222"
},
{
"cve": "CVE-2015-2316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2316"
}
],
"notes": [
{
"category": "general",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2316",
"url": "https://www.suse.com/security/cve/CVE-2015-2316"
},
{
"category": "external",
"summary": "SUSE Bug 923172 for CVE-2015-2316",
"url": "https://bugzilla.suse.com/923172"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2316"
},
{
"cve": "CVE-2015-2317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2317"
}
],
"notes": [
{
"category": "general",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2317",
"url": "https://www.suse.com/security/cve/CVE-2015-2317"
},
{
"category": "external",
"summary": "SUSE Bug 923176 for CVE-2015-2317",
"url": "https://bugzilla.suse.com/923176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2317"
}
]
}
suse-su-2015:0563-1
Vulnerability from csaf_suse
Published
2014-09-03 15:51
Modified
2014-09-03 15:51
Summary
Security update for python-django
Notes
Title of the patch
Security update for python-django
Description of the patch
python-django was updated to 1.5.10 fixing bugs and security issues:
* Prevented reverse() from generating URLs pointing to other hosts to
prevent phishing attacks. (bnc#893087, CVE-2014-0480)
* Removed O(n) algorithm when uploading duplicate file names to fix
file upload denial of service. (bnc#893088, CVE-2014-0481)
* Modified RemoteUserMiddleware to logout on REMOTE_USE change to
prevent session hijacking. (bnc#893089, CVE-2014-0482)
* Prevented data leakage in contrib.admin via query string
manipulation. (bnc#893090, CVE-2014-0483)
Security Issues:
* CVE-2014-0480
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480>
* CVE-2014-0481
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481>
* CVE-2014-0482
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482>
* CVE-2014-0483
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483>
Patchnames
sleclo40sp3-python-django
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n * Prevented reverse() from generating URLs pointing to other hosts to\n prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n * Removed O(n) algorithm when uploading duplicate file names to fix\n file upload denial of service. (bnc#893088, CVE-2014-0481)\n * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n prevent session hijacking. (bnc#893089, CVE-2014-0482)\n * Prevented data leakage in contrib.admin via query string\n manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n * CVE-2014-0480\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n * CVE-2014-0481\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n * CVE-2014-0482\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n * CVE-2014-0483\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleclo40sp3-python-django",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0563-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0563-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0563-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-March/001310.html"
},
{
"category": "self",
"summary": "SUSE Bug 893087",
"url": "https://bugzilla.suse.com/893087"
},
{
"category": "self",
"summary": "SUSE Bug 893088",
"url": "https://bugzilla.suse.com/893088"
},
{
"category": "self",
"summary": "SUSE Bug 893089",
"url": "https://bugzilla.suse.com/893089"
},
{
"category": "self",
"summary": "SUSE Bug 893090",
"url": "https://bugzilla.suse.com/893090"
},
{
"category": "self",
"summary": "SUSE Bug 913053",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "self",
"summary": "SUSE Bug 913054",
"url": "https://bugzilla.suse.com/913054"
},
{
"category": "self",
"summary": "SUSE Bug 913055",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "self",
"summary": "SUSE Bug 913056",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "self",
"summary": "SUSE Bug 914706",
"url": "https://bugzilla.suse.com/914706"
},
{
"category": "self",
"summary": "SUSE Bug 923176",
"url": "https://bugzilla.suse.com/923176"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0480 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0480/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0481 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0481/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0482 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0482/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0483 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0483/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0219 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0219/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0220 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0220/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0221 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0221/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2316 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2317/"
}
],
"title": "Security update for python-django",
"tracking": {
"current_release_date": "2014-09-03T15:51:02Z",
"generator": {
"date": "2014-09-03T15:51:02Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0563-1",
"initial_release_date": "2014-09-03T15:51:02Z",
"revision_history": [
{
"date": "2014-09-03T15:51:02Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-django-1.5.10-0.11.1.x86_64",
"product": {
"name": "python-django-1.5.10-0.11.1.x86_64",
"product_id": "python-django-1.5.10-0.11.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 4",
"product": {
"name": "SUSE OpenStack Cloud 4",
"product_id": "SUSE OpenStack Cloud 4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:cloud:4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-1.5.10-0.11.1.x86_64 as component of SUSE OpenStack Cloud 4",
"product_id": "SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
},
"product_reference": "python-django-1.5.10-0.11.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0480",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0480"
}
],
"notes": [
{
"category": "general",
"text": "The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0480",
"url": "https://www.suse.com/security/cve/CVE-2014-0480"
},
{
"category": "external",
"summary": "SUSE Bug 893087 for CVE-2014-0480",
"url": "https://bugzilla.suse.com/893087"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0480",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0480"
},
{
"cve": "CVE-2014-0481",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0481"
}
],
"notes": [
{
"category": "general",
"text": "The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0481",
"url": "https://www.suse.com/security/cve/CVE-2014-0481"
},
{
"category": "external",
"summary": "SUSE Bug 893088 for CVE-2014-0481",
"url": "https://bugzilla.suse.com/893088"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0481",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0481"
},
{
"cve": "CVE-2014-0482",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0482"
}
],
"notes": [
{
"category": "general",
"text": "The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0482",
"url": "https://www.suse.com/security/cve/CVE-2014-0482"
},
{
"category": "external",
"summary": "SUSE Bug 893089 for CVE-2014-0482",
"url": "https://bugzilla.suse.com/893089"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0482",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2014-0482"
},
{
"cve": "CVE-2014-0483",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0483"
}
],
"notes": [
{
"category": "general",
"text": "The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1\u0026t=password URI.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0483",
"url": "https://www.suse.com/security/cve/CVE-2014-0483"
},
{
"category": "external",
"summary": "SUSE Bug 893090 for CVE-2014-0483",
"url": "https://bugzilla.suse.com/893090"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2014-0483",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "low"
}
],
"title": "CVE-2014-0483"
},
{
"cve": "CVE-2015-0219",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0219"
}
],
"notes": [
{
"category": "general",
"text": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0219",
"url": "https://www.suse.com/security/cve/CVE-2015-0219"
},
{
"category": "external",
"summary": "SUSE Bug 913053 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0219"
},
{
"cve": "CVE-2015-0220",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0220"
}
],
"notes": [
{
"category": "general",
"text": "The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \"\\njavascript:\" URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0220",
"url": "https://www.suse.com/security/cve/CVE-2015-0220"
},
{
"category": "external",
"summary": "SUSE Bug 913054 for CVE-2015-0220",
"url": "https://bugzilla.suse.com/913054"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0220",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0220"
},
{
"cve": "CVE-2015-0221",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0221"
}
],
"notes": [
{
"category": "general",
"text": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0221",
"url": "https://www.suse.com/security/cve/CVE-2015-0221"
},
{
"category": "external",
"summary": "SUSE Bug 913056 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0221"
},
{
"cve": "CVE-2015-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0222"
}
],
"notes": [
{
"category": "general",
"text": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0222",
"url": "https://www.suse.com/security/cve/CVE-2015-0222"
},
{
"category": "external",
"summary": "SUSE Bug 913055 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-0222"
},
{
"cve": "CVE-2015-2316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2316"
}
],
"notes": [
{
"category": "general",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2316",
"url": "https://www.suse.com/security/cve/CVE-2015-2316"
},
{
"category": "external",
"summary": "SUSE Bug 923172 for CVE-2015-2316",
"url": "https://bugzilla.suse.com/923172"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2316"
},
{
"cve": "CVE-2015-2317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2317"
}
],
"notes": [
{
"category": "general",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2317",
"url": "https://www.suse.com/security/cve/CVE-2015-2317"
},
{
"category": "external",
"summary": "SUSE Bug 923176 for CVE-2015-2317",
"url": "https://bugzilla.suse.com/923176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 4:python-django-1.5.10-0.11.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2014-09-03T15:51:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2317"
}
]
}
suse-su-2015:0694-1
Vulnerability from csaf_suse
Published
2015-03-25 23:21
Modified
2015-03-25 23:21
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
python-Django has been updated to fix two vulnerabilities:
* URLs starting with control characters could have allowed XSS
(cross-site-scripting) attacks via user-supplied redirect URLs
(CVE-2015-2317)
* An infinite loop possibility could be triggered in the strip_tags()
function, which allowed denial of service attacks (CVE-2015-2316)
Security Issues:
* CVE-2015-2316
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2316>
* CVE-2015-2317
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2317>
Patchnames
sleclo50sp3-python-Django
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\npython-Django has been updated to fix two vulnerabilities:\n\n * URLs starting with control characters could have allowed XSS\n (cross-site-scripting) attacks via user-supplied redirect URLs\n (CVE-2015-2317)\n * An infinite loop possibility could be triggered in the strip_tags()\n function, which allowed denial of service attacks (CVE-2015-2316)\n\nSecurity Issues:\n\n * CVE-2015-2316\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2316\u003e\n * CVE-2015-2317\n \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2317\u003e\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleclo50sp3-python-Django",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0694-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:0694-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150694-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:0694-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-April/001339.html"
},
{
"category": "self",
"summary": "SUSE Bug 923172",
"url": "https://bugzilla.suse.com/923172"
},
{
"category": "self",
"summary": "SUSE Bug 923176",
"url": "https://bugzilla.suse.com/923176"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2316 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2317/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2015-03-25T23:21:02Z",
"generator": {
"date": "2015-03-25T23:21:02Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:0694-1",
"initial_release_date": "2015-03-25T23:21:02Z",
"revision_history": [
{
"date": "2015-03-25T23:21:02Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-0.7.1.x86_64",
"product": {
"name": "python-Django-1.6.11-0.7.1.x86_64",
"product_id": "python-Django-1.6.11-0.7.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 5",
"product": {
"name": "SUSE OpenStack Cloud 5",
"product_id": "SUSE OpenStack Cloud 5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:cloud:5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-0.7.1.x86_64 as component of SUSE OpenStack Cloud 5",
"product_id": "SUSE OpenStack Cloud 5:python-Django-1.6.11-0.7.1.x86_64"
},
"product_reference": "python-Django-1.6.11-0.7.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-2316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2316"
}
],
"notes": [
{
"category": "general",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-0.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2316",
"url": "https://www.suse.com/security/cve/CVE-2015-2316"
},
{
"category": "external",
"summary": "SUSE Bug 923172 for CVE-2015-2316",
"url": "https://bugzilla.suse.com/923172"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-0.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-25T23:21:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2316"
},
{
"cve": "CVE-2015-2317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2317"
}
],
"notes": [
{
"category": "general",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-0.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2317",
"url": "https://www.suse.com/security/cve/CVE-2015-2317"
},
{
"category": "external",
"summary": "SUSE Bug 923176 for CVE-2015-2317",
"url": "https://bugzilla.suse.com/923176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-0.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-25T23:21:02Z",
"details": "moderate"
}
],
"title": "CVE-2015-2317"
}
]
}
suse-su-2015:1112-1
Vulnerability from csaf_suse
Published
2015-03-30 09:04
Modified
2015-03-30 09:04
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
python-django was updated to 1.6.11 to fix security issues and non-security bugs.
The following vulnerabilities were fixed:
* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)
* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)
* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)
* Mitigated possible XSS attack via user-supplied redirect URLs
* Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221)
* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)
The update also contains fixes for non-security bugs, functional and stability issues.
Patchnames
SUSE-Storage-1.0-2015-271
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-Storage-1.0-2015-271",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_1112-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:1112-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20151112-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:1112-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-June/001453.html"
},
{
"category": "self",
"summary": "SUSE Bug 913053",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "self",
"summary": "SUSE Bug 913055",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "self",
"summary": "SUSE Bug 913056",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "self",
"summary": "SUSE Bug 923172",
"url": "https://bugzilla.suse.com/923172"
},
{
"category": "self",
"summary": "SUSE Bug 923176",
"url": "https://bugzilla.suse.com/923176"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0219 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0219/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0221 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0221/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2316 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2317/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2015-03-30T09:04:33Z",
"generator": {
"date": "2015-03-30T09:04:33Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:1112-1",
"initial_release_date": "2015-03-30T09:04:33Z",
"revision_history": [
{
"date": "2015-03-30T09:04:33Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-4.1.noarch",
"product": {
"name": "python-Django-1.6.11-4.1.noarch",
"product_id": "python-Django-1.6.11-4.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Enterprise Storage 1.0",
"product": {
"name": "SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:1.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-4.1.noarch as component of SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
},
"product_reference": "python-Django-1.6.11-4.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 1.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0219",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0219"
}
],
"notes": [
{
"category": "general",
"text": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0219",
"url": "https://www.suse.com/security/cve/CVE-2015-0219"
},
{
"category": "external",
"summary": "SUSE Bug 913053 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0219"
},
{
"cve": "CVE-2015-0221",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0221"
}
],
"notes": [
{
"category": "general",
"text": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0221",
"url": "https://www.suse.com/security/cve/CVE-2015-0221"
},
{
"category": "external",
"summary": "SUSE Bug 913056 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0221"
},
{
"cve": "CVE-2015-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0222"
}
],
"notes": [
{
"category": "general",
"text": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0222",
"url": "https://www.suse.com/security/cve/CVE-2015-0222"
},
{
"category": "external",
"summary": "SUSE Bug 913055 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0222"
},
{
"cve": "CVE-2015-2316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2316"
}
],
"notes": [
{
"category": "general",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2316",
"url": "https://www.suse.com/security/cve/CVE-2015-2316"
},
{
"category": "external",
"summary": "SUSE Bug 923172 for CVE-2015-2316",
"url": "https://bugzilla.suse.com/923172"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-2316"
},
{
"cve": "CVE-2015-2317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2317"
}
],
"notes": [
{
"category": "general",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2317",
"url": "https://www.suse.com/security/cve/CVE-2015-2317"
},
{
"category": "external",
"summary": "SUSE Bug 923176 for CVE-2015-2317",
"url": "https://bugzilla.suse.com/923176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-2317"
}
]
}
suse-su-2015:1109-1
Vulnerability from csaf_suse
Published
2015-03-30 09:04
Modified
2015-03-30 09:04
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
python-django was updated to 1.6.11 to fix security issues and non-security bugs.
The following vulnerabilities were fixed:
* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)
* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)
* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)
* Mitigated possible XSS attack via user-supplied redirect URLs
* Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221)
* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)
The update also contains fixes for non-security bugs, functional and stability issues.
Patchnames
SUSE-Storage-1.0-2015-271
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve`` (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-Storage-1.0-2015-271",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_1109-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:1109-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20151109-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:1109-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-June/001452.html"
},
{
"category": "self",
"summary": "SUSE Bug 913053",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "self",
"summary": "SUSE Bug 913055",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "self",
"summary": "SUSE Bug 913056",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "self",
"summary": "SUSE Bug 923172",
"url": "https://bugzilla.suse.com/923172"
},
{
"category": "self",
"summary": "SUSE Bug 923176",
"url": "https://bugzilla.suse.com/923176"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0219 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0219/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0221 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0221/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-0222 page",
"url": "https://www.suse.com/security/cve/CVE-2015-0222/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2316 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2317 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2317/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2015-03-30T09:04:33Z",
"generator": {
"date": "2015-03-30T09:04:33Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:1109-1",
"initial_release_date": "2015-03-30T09:04:33Z",
"revision_history": [
{
"date": "2015-03-30T09:04:33Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-4.1.noarch",
"product": {
"name": "python-Django-1.6.11-4.1.noarch",
"product_id": "python-Django-1.6.11-4.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Enterprise Storage 1.0",
"product": {
"name": "SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:1.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-4.1.noarch as component of SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
},
"product_reference": "python-Django-1.6.11-4.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 1.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-0219",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0219"
}
],
"notes": [
{
"category": "general",
"text": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0219",
"url": "https://www.suse.com/security/cve/CVE-2015-0219"
},
{
"category": "external",
"summary": "SUSE Bug 913053 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/913053"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0219",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0219"
},
{
"cve": "CVE-2015-0221",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0221"
}
],
"notes": [
{
"category": "general",
"text": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0221",
"url": "https://www.suse.com/security/cve/CVE-2015-0221"
},
{
"category": "external",
"summary": "SUSE Bug 913056 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/913056"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0221",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0221"
},
{
"cve": "CVE-2015-0222",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-0222"
}
],
"notes": [
{
"category": "general",
"text": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-0222",
"url": "https://www.suse.com/security/cve/CVE-2015-0222"
},
{
"category": "external",
"summary": "SUSE Bug 913055 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/913055"
},
{
"category": "external",
"summary": "SUSE Bug 919763 for CVE-2015-0222",
"url": "https://bugzilla.suse.com/919763"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-0222"
},
{
"cve": "CVE-2015-2316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2316"
}
],
"notes": [
{
"category": "general",
"text": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2316",
"url": "https://www.suse.com/security/cve/CVE-2015-2316"
},
{
"category": "external",
"summary": "SUSE Bug 923172 for CVE-2015-2316",
"url": "https://bugzilla.suse.com/923172"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-2316"
},
{
"cve": "CVE-2015-2317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2317"
}
],
"notes": [
{
"category": "general",
"text": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2317",
"url": "https://www.suse.com/security/cve/CVE-2015-2317"
},
{
"category": "external",
"summary": "SUSE Bug 923176 for CVE-2015-2317",
"url": "https://bugzilla.suse.com/923176"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-4.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-03-30T09:04:33Z",
"details": "moderate"
}
],
"title": "CVE-2015-2317"
}
]
}
gsd-2015-2316
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2015-2316",
"description": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"id": "GSD-2015-2316",
"references": [
"https://www.suse.com/security/cve/CVE-2015-2316.html",
"https://ubuntu.com/security/CVE-2015-2316",
"https://advisories.mageia.org/CVE-2015-2316.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2015-2316"
],
"details": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"id": "GSD-2015-2316",
"modified": "2023-12-13T01:20:00.235957Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-2539-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"name": "73322",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/73322"
},
{
"name": "FEDORA-2015-5766",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "openSUSE-SU-2015:0643",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"name": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/",
"refsource": "CONFIRM",
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2316"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-2539-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"name": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
},
{
"name": "openSUSE-SU-2015:0643",
"refsource": "SUSE",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"name": "FEDORA-2015-5766",
"refsource": "FEDORA",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"name": "73322",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/73322"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2018-10-30T16:27Z",
"publishedDate": "2015-03-25T14:59Z"
}
}
}
pysec-2015-18
Vulnerability from pysec
Published
2015-03-25 14:59
Modified
2021-09-01 08:35
Details
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Impacted products
| Name | purl | django | pkg:pypi/django |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django",
"purl": "pkg:pypi/django"
},
"ranges": [
{
"events": [
{
"introduced": "1.6"
},
{
"fixed": "1.6.11"
},
{
"introduced": "1.7"
},
{
"fixed": "1.7.7"
},
{
"introduced": "1.8a0"
},
{
"fixed": "1.8c1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.6",
"1.6.1",
"1.6.10",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7",
"1.7.1",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.8a1",
"1.8b1",
"1.8b2"
]
}
],
"aliases": [
"CVE-2015-2316"
],
"details": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
"id": "PYSEC-2015-18",
"modified": "2021-09-01T08:35:41.398239Z",
"published": "2015-03-25T14:59:00Z",
"references": [
{
"type": "ADVISORY",
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"type": "ARTICLE",
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/73322"
}
]
}
fkie_cve-2015-2316
Vulnerability from fkie_nvd
Published
2015-03-25 14:59
Modified
2025-04-12 10:46
Severity ?
Summary
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html | Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html | Third Party Advisory | |
| cve@mitre.org | http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/73322 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-2539-1 | Third Party Advisory | |
| cve@mitre.org | https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/73322 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-2539-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| oracle | solaris | 11.2 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6.1 | |
| djangoproject | django | 1.6.2 | |
| djangoproject | django | 1.6.3 | |
| djangoproject | django | 1.6.4 | |
| djangoproject | django | 1.6.5 | |
| djangoproject | django | 1.6.6 | |
| djangoproject | django | 1.6.7 | |
| djangoproject | django | 1.6.8 | |
| djangoproject | django | 1.6.9 | |
| djangoproject | django | 1.6.10 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7.1 | |
| djangoproject | django | 1.7.2 | |
| djangoproject | django | 1.7.3 | |
| djangoproject | django | 1.7.4 | |
| djangoproject | django | 1.7.5 | |
| djangoproject | django | 1.7.6 | |
| djangoproject | django | 1.8.0 | |
| canonical | ubuntu_linux | 10.04 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 14.04 | |
| canonical | ubuntu_linux | 14.10 | |
| fedoraproject | fedora | 22 | |
| opensuse | opensuse | 13.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1C288F-326B-497B-B26C-D26E01262DDB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:*",
"matchCriteriaId": "29477EEA-D5F8-45A9-9777-8A6BC7C668A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A83451BD-1D67-4A7F-A62C-F597E51FCC21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0300DC0D-5DD0-42B5-9FE0-54DC557EA40D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:*",
"matchCriteriaId": "85A2021F-B2AF-40DC-9FA2-5F90D2EB813E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:*",
"matchCriteriaId": "07B12D68-BB49-4931-9D9E-D8134FC0B350",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0CC369A0-0092-450D-91E9-13C7AF7EBC16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4B6B7974-ABEF-4E0C-8503-6E9C22D28C78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "55460F1D-661B-465C-8A22-E4E6DA2834B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9FD4FB46-3A98-4B9B-A241-C39E2C2A0FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FF87FDAB-51A2-41C4-A4C4-5180B0230C3F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "80E8431B-FEA1-4D94-B367-56E8678C3CD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81E7779A-EDB9-4871-8D7C-63C5A7C7A0DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "ABB56113-5E66-4EE9-B551-FD40C2FE307B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A2985241-279F-46AC-8BBF-DF2F439FE720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "D6D0F178-D3DE-4E1D-B666-B40262CDF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:*",
"matchCriteriaId": "BB1EF6D7-0AF4-4146-BA37-961F7048C1C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:*",
"matchCriteriaId": "5E4CCE84-425C-4B9C-98B7-D858B64B3418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:*",
"matchCriteriaId": "B6B77FCE-F26A-41CB-8D72-E9EF0E352288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:beta4:*:*:*:*:*:*",
"matchCriteriaId": "985884FE-AEB9-4D93-806E-ADFCC576FF99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D81EE1B4-9CB4-4776-A7CE-44B023C67CA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:rc2:*:*:*:*:*:*",
"matchCriteriaId": "81798B3D-A000-40D5-A369-C9A0BEF79A5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7:rc3:*:*:*:*:*:*",
"matchCriteriaId": "32DDDBEB-6F2F-4BA9-876D-38D41BA29726",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "06513AE1-11E4-4A9C-BDA4-D0511A9DCFC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6004EA17-A2B4-4E4C-A738-210FCAC2CA32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "61680046-51CD-4217-AC1E-C11265205DB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4320AE65-B4A7-4CC3-8BE0-6CD4FFBC24C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "18E5B08A-E6FC-440C-A2F8-1D8B727D55E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6DAD077F-A239-4021-890E-AD4D9D9A388D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "02D3C0FF-C342-40F1-A187-CD212C16FE8F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "5D37DF0F-F863-45AC-853A-3E04F9FEC7CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
"matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string."
},
{
"lang": "es",
"value": "La funci\u00f3n utils.html.strip_tags en Django 1.6.x anterior a 1.6.11, 1.7.x anterior a 1.7.7, y 1.8.x anterior a 1.8c1, cuando utiliza ciertos versiones de Python, permite a atacantes remotos causar una denegaci\u00f3n de servicio (bucle infinito) mediante el incremento de la longitud de la cadena de entradas."
}
],
"id": "CVE-2015-2316",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-03-25T14:59:02.940",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/73322"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/73322"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2539-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/mar/18/security-releases/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…