PT-2015-7744 · Django Software Foundation+2 · Django+2

Ryan Butterfield · Published 2015-11-24 · Updated 2022-05-17 · CVE-2015-8213

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.7.x before 1.7.11 Django versions 1.8.x before 1.8.7 Django versions 1.9.x before 1.9rc2

Description The issue allows remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by the SECRET KEY. This occurs due to a problem in the get format function in utils/formats.py.

Recommendations For Django versions 1.7.x before 1.7.11, update to version 1.7.11 or later. For Django versions 1.8.x before 1.8.7, update to version 1.8.7 or later. For Django versions 1.9.x before 1.9rc2, update to version 1.9rc2 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-2030

CVE-2015-8213

DLA-349-1

DSA-3404-1

GHSA-6WCR-WCQM-3MFH

MGASA-2015-0463

PYSEC-2015-11

RHSA-2016:0129

RHSA-2016:0156

RHSA-2016:0157

RHSA-2016:0158

RHSA-2016:0360

SUSE-SU-2015:2327-1

SUSE-SU-2016:0040-1

SUSE-SU-2016:0044-1

USN-2816-1

Affected Products

Alt Linux

Django

Ubuntu

References · 49

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8213 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0463 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2816-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6wcr-wcqm-3mfh · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html · Vendor Advisory
• https://djangoproject.com/weblog/2015/nov/24/security-releases-issued · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0129.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8213 · Security Note
• https://osv.dev/vulnerability/USN-2816-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-0157.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0463.html · Security Note
• https://osv.dev/vulnerability/DSA-3404-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8213 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8213 · Security Note