PT-2015-7744 · Django Software Foundation+2 · Django+2

Ryan Butterfield · Publicado 2015-11-24 · Atualizado 2022-05-17 · CVE-2015-8213

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.7.x before 1.7.11 Django versions 1.8.x before 1.8.7 Django versions 1.9.x before 1.9rc2

Description The issue allows remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by the SECRET KEY. This occurs due to a problem in the get format function in utils/formats.py.

Recommendations For Django versions 1.7.x before 1.7.11, update to version 1.7.11 or later. For Django versions 1.8.x before 1.8.7, update to version 1.8.7 or later. For Django versions 1.9.x before 1.9rc2, update to version 1.9rc2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2015-2030

CVE-2015-8213

DLA-349-1

DSA-3404-1

GHSA-6WCR-WCQM-3MFH

MGASA-2015-0463

PYSEC-2015-11

RHSA-2016:0129

RHSA-2016:0156

RHSA-2016:0157

RHSA-2016:0158

RHSA-2016:0360

SUSE-SU-2015:2327-1

SUSE-SU-2016:0040-1

SUSE-SU-2016:0044-1

USN-2816-1

Produtos afetados

Alt Linux

Django

Ubuntu

Referências · 49

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4 · Nota
• https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991 · Nota
• https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172 · Nota
• https://github.com/django/django/commit/3ebbda0aef9e7a90ac6208bb8f9bc21228e2c7da · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-11.yaml · Nota
• http://securityfocus.com/bid/77750 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8213 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5143 · Nota
• https://osv.dev/vulnerability/MGASA-2015-0463 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2816-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6wcr-wcqm-3mfh · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html · Aviso do Fabricante
• https://djangoproject.com/weblog/2015/nov/24/security-releases-issued · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-0129.html · Aviso do Fabricante