PT-2015-5709 · Django Software Foundation+2 · Django+2

Andrey Babak · Published 2015-03-19 · Updated 2022-05-14 · CVE-2015-2316

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.6.x through 1.6.10 Django versions 1.7.x through 1.7.6 Django versions 1.8.x through 1.8c1 (exclusive of 1.8c1)

Description The issue allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string, specifically when using certain versions of Python. This is related to the utils.html.strip tags function.

Recommendations For Django versions 1.6.x through 1.6.10, update to version 1.6.11 or later. For Django versions 1.7.x through 1.7.6, update to version 1.7.7 or later. For Django versions 1.8.x through 1.8c1 (exclusive of 1.8c1), update to version 1.8c1 or later. As a temporary workaround, consider restricting the input length to prevent infinite loops in the utils.html.strip tags function.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-399

CWE-770

Related Identifiers

CVE-2015-2316

GHSA-J3J3-JRFH-CM2W

MGASA-2015-0127

PYSEC-2015-18

SUSE-SU-2015:0563-1

SUSE-SU-2015:0694-1

SUSE-SU-2015:0695-1

SUSE-SU-2015:1109-1

SUSE-SU-2015:1112-1

USN-2539-1

Affected Products

Django

Python

Ubuntu

References · 42

• http://ubuntu.com/usn/USN-2539-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2316 · Security Note
• https://ubuntu.com/security/CVE-2015-2316 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html · Vendor Advisory
• https://djangoproject.com/weblog/2015/mar/18/security-releases · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0127.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-2316 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1109-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2539-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2316 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1112-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2539-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0127 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3j3-jrfh-cm2w · Vendor Advisory