PT-2015-2246 · Django Software Foundation+2 · Django+2

Sjoerd Job Postmus · Publicado 2015-07-08 · Atualizado 2022-05-17 · CVE-2015-5144

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.5.x through 1.6.x Django versions 1.7.x before 1.7.9 Django versions 1.8.x before 1.8.3 Django before 1.4.21

Description The issue is related to resource management errors in the Django web application platform. It can be exploited by a remote attacker to cause a denial of service by creating multiple requests with unique session keys. The vulnerability also allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an email message, URL, or unspecified vectors to certain validators.

Recommendations For Django before 1.4.21, update to version 1.4.21 or later. For Django versions 1.5.x through 1.6.x, update to version 1.7.9 or later. For Django versions 1.7.x before 1.7.9, update to version 1.7.9 or later. For Django versions 1.8.x before 1.8.3, update to version 1.8.3 or later. As a temporary workaround, consider restricting access to the EmailValidator, URLValidator, validate ipv4 address, and validate slug validator functions until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-399

Identificadores relacionados

ALT-PU-2015-1872

BDU:2015-11592

CVE-2015-5144

DLA-272-1

DSA-3305-1

GHSA-Q5QW-4364-5HHM

MGASA-2015-0293

PYSEC-2015-10

SUSE-SU-2015:1810-1

SUSE-SU-2015:1815-1

SUSE-SU-2016:0044-1

USN-2671-1

Produtos afetados

Alt Linux

Django

Ubuntu

Referências · 51

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a · Nota
• https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54 · Nota
• https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649 · Nota
• https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c · Nota
• https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5144 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-5143 · Nota
• https://cve.org/CVERecord?id=CVE-2015-5144 · Nota de Segurança
• http://securitytracker.com/id/1032820 · Nota
• https://djangoproject.com/weblog/2015/jul/08/security-releases · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-5143 · Aviso do Fabricante
• https://debian.org/security/2015/dsa-3305 · Aviso do Fabricante