HIGH7.8
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
ALT-PU-2014-3206-1Обновление пакета python-module-django в ветке sisyphus
Серьёзность:
Закрытые проблемы (10)
MEDIUM4.3
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NMEDIUM5.0
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73322
- http://www.ubuntu.com/usn/USN-2539-1
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73322
- http://www.ubuntu.com/usn/USN-2539-1
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
MEDIUM4.3
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases/
HIGH7.8
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
CVSS 2.0ВЫСОКАЯ 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75666
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75666
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
MEDIUM4.3
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:NСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75665
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75665
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
MEDIUM5.3
Django cross-site scripting (XSS) attack via user-supplied redirect URLs
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVSS 4.0СРЕДНЯЯ 5.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NСсылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-2317
- https://github.com/django/django/commit/2342693b31f740a422abf7267c53b4e7bc487c1b
- https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1
- https://github.com/django/django/commit/5510f070711540aaa8d3707776cd77494e688ef9
- https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-9.yaml
- https://web.archive.org/web/20200228131706/http://www.securityfocus.com/bid/73319
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160263.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html
- http://ubuntu.com/usn/usn-2539-1
- http://www.debian.org/security/2015/dsa-3204
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:195
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- CVE-2015-2317
HIGH8.7
Django Denial-of-service by filling session store
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 4.0ВЫСОКАЯ 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NСсылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-5143
- https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663
- https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9
- https://github.com/django/django/commit/66d12d1ababa8f062857ee5eb43276493720bf16
- https://github.com/advisories/GHSA-h582-2pch-3xv3
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-20.yaml
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2015-1678.html
- http://rhn.redhat.com/errata/RHSA-2015-1686.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.ubuntu.com/usn/USN-2671-1
- CVE-2015-5143
HIGH8.7
Django Denial-of-service possibility with strip_tags
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 4.0ВЫСОКАЯ 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NСсылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-2316
- https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd
- https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f
- https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml
- https://web.archive.org/web/20200229033201/http://www.securityfocus.com/bid/73322
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html
- http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.ubuntu.com/usn/USN-2539-1
- CVE-2015-2316
HIGH8.7
Django Vulnerable to HTTP Response Splitting Attack
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS 4.0ВЫСОКАЯ 8.7
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NСсылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-5144
- https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a
- https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0
- https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c
- https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649
- https://github.com/django/django
- https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml
- https://security.gentoo.org/glsa/201510-06
- https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820
- https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.ubuntu.com/usn/USN-2671-1
- CVE-2015-5144