HIGH7.8
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CReferences
ALT-PU-2014-3206-1Package update python-module-django in branch sisyphus
Severity:
Closed issues (10)
MEDIUM4.3
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NReferences
MEDIUM5.0
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PReferences
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73322
- http://www.ubuntu.com/usn/USN-2539-1
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73322
- http://www.ubuntu.com/usn/USN-2539-1
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
MEDIUM4.3
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NReferences
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
HIGH7.8
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CReferences
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75666
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75666
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
MEDIUM4.3
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NReferences
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75665
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75665
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
MEDIUM5.3
Django cross-site scripting (XSS) attack via user-supplied redirect URLs
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVSS 4.0MEDIUM 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
- https://nvd.nist.gov/vuln/detail/CVE-2015-2317
- https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b
- https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1
- https://github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef9
- https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-9.yaml
- https://web.archive.org/web/20200228131706/http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
HIGH8.7
Django Denial-of-service by filling session store
CVSS 3.xHIGH 8.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 4.0HIGH 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
- https://nvd.nist.gov/vuln/detail/CVE-2015-5143
- https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663
- https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9
- https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16
- https://github.com/advisories/GHSA-h582-2pch-3xv3
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-20.yaml
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.ubuntu.com/usn/USN-2671-1
HIGH8.7
Django Denial-of-service possibility with strip_tags
CVSS 3.xHIGH 8.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 4.0HIGH 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
- https://nvd.nist.gov/vuln/detail/CVE-2015-2316
- https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd
- https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f
- https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml
- https://web.archive.org/web/20200229033201/http://www.securityfocus.com/bid/73322
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.ubuntu.com/usn/USN-2539-1
HIGH8.7
Django Vulnerable to HTTP Response Splitting Attack
CVSS 3.xHIGH 8.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS 4.0HIGH 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
- https://nvd.nist.gov/vuln/detail/CVE-2015-5144
- https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a
- https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0
- https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c
- https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649
- https://github.com/django/django
- https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml
- https://security.gentoo.org/glsa/201510-06
- https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820
- https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.ubuntu.com/usn/USN-2671-1