PT-2015-2246 · Django Software Foundation+2 · Django+2

Sjoerd Job Postmus · Published 2015-07-08 · Updated 2022-05-17 · CVE-2015-5144

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.5.x through 1.6.x Django versions 1.7.x before 1.7.9 Django versions 1.8.x before 1.8.3 Django before 1.4.21

Description The issue is related to resource management errors in the Django web application platform. It can be exploited by a remote attacker to cause a denial of service by creating multiple requests with unique session keys. The vulnerability also allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an email message, URL, or unspecified vectors to certain validators.

Recommendations For Django before 1.4.21, update to version 1.4.21 or later. For Django versions 1.5.x through 1.6.x, update to version 1.7.9 or later. For Django versions 1.7.x before 1.7.9, update to version 1.7.9 or later. For Django versions 1.8.x before 1.8.3, update to version 1.8.3 or later. As a temporary workaround, consider restricting access to the EmailValidator, URLValidator, validate ipv4 address, and validate slug validator functions until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-399

Related Identifiers

ALT-PU-2015-1872

BDU:2015-11592

CVE-2015-5144

DLA-272-1

DSA-3305-1

GHSA-Q5QW-4364-5HHM

MGASA-2015-0293

PYSEC-2015-10

SUSE-SU-2015:1810-1

SUSE-SU-2015:1815-1

SUSE-SU-2016:0044-1

USN-2671-1

Affected Products

Alt Linux

Django

Ubuntu

References · 51

• https://nvd.nist.gov/vuln/detail/CVE-2015-5144 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5144 · Security Note
• https://djangoproject.com/weblog/2015/jul/08/security-releases · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5143 · Vendor Advisory
• https://debian.org/security/2015/dsa-3305 · Vendor Advisory
• https://security.gentoo.org/glsa/201510-06 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2671-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html · Vendor Advisory
• http://debian.org/security/2015/dsa-3305 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1815-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2671-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5144 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5144 · Vendor Advisory