PT-2015-5709 · Django Software Foundation+2 · Django+2

Andrey Babak · Publicado 2015-03-19 · Atualizado 2022-05-14 · CVE-2015-2316

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.6.x through 1.6.10 Django versions 1.7.x through 1.7.6 Django versions 1.8.x through 1.8c1 (exclusive of 1.8c1)

Description The issue allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string, specifically when using certain versions of Python. This is related to the utils.html.strip tags function.

Recommendations For Django versions 1.6.x through 1.6.10, update to version 1.6.11 or later. For Django versions 1.7.x through 1.7.6, update to version 1.7.7 or later. For Django versions 1.8.x through 1.8c1 (exclusive of 1.8c1), update to version 1.8c1 or later. As a temporary workaround, consider restricting the input length to prevent infinite loops in the utils.html.strip tags function.

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-399

CWE-770

Identificadores relacionados

CVE-2015-2316

GHSA-J3J3-JRFH-CM2W

MGASA-2015-0127

PYSEC-2015-18

SUSE-SU-2015:0563-1

SUSE-SU-2015:0694-1

SUSE-SU-2015:0695-1

SUSE-SU-2015:1109-1

SUSE-SU-2015:1112-1

USN-2539-1

Produtos afetados

Django

Python

Ubuntu

Referências · 42

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd · Nota
• https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f · Nota
• https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml · Nota
• https://bugzilla.suse.com/913056 · Nota
• http://ubuntu.com/usn/USN-2539-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=15528 · Nota
• https://suse.com/security/cve/CVE-2015-2317 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2316 · Nota de Segurança
• https://djangoproject.com/weblog/2015/mar/09/security-releases · Nota
• https://ubuntu.com/security/CVE-2015-2316 · Aviso do Fabricante
• https://bugzilla.suse.com/913055 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20151112-1 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html · Aviso do Fabricante