rpm package
opensuse/python-Django&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/python-Django&distro=openSUSE%20Tumbleweed
Vulnerabilities (92)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-7537 | Med | 5.3 | < 3.2.7-2.3 | 3.2.7-2.3 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking | |
| CVE-2018-7536 | Med | 5.3 | < 3.2.7-2.3 | 3.2.7-2.3 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr | |
| CVE-2018-6188 | Hig | 7.5 | < 3.2.7-2.3 | 3.2.7-2.3 | Feb 5, 2018 | django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a | |
| CVE-2017-12794 | Med | 6.1 | < 3.2.7-2.3 | 3.2.7-2.3 | Sep 7, 2017 | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si | |
| CVE-2017-7234 | Med | 6.1 | < 3.2.7-2.3 | 3.2.7-2.3 | Apr 4, 2017 | A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. | |
| CVE-2017-7233 | Med | 6.1 | < 3.2.7-2.3 | 3.2.7-2.3 | Apr 4, 2017 | Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh | |
| CVE-2016-7401 | Hig | 7.5 | < 3.2.7-2.3 | 3.2.7-2.3 | Oct 3, 2016 | The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. | |
| CVE-2016-2513 | Low | 3.1 | < 1.10.4-1.1 | 1.10.4-1.1 | Apr 8, 2016 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests. | |
| CVE-2016-2512 | Hig | 7.4 | < 1.10.4-1.1 | 1.10.4-1.1 | Apr 8, 2016 | The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de | |
| CVE-2015-5963 | — | < 1.9.12-1.1 | 1.9.12-1.1 | Aug 24, 2015 | contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of reque | ||
| CVE-2015-5145 | — | < 1.9.12-1.1 | 1.9.12-1.1 | Jul 14, 2015 | validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. | ||
| CVE-2015-3982 | — | < 1.9.12-1.1 | 1.9.12-1.1 | Jun 2, 2015 | The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. |
- affected < 3.2.7-2.3fixed 3.2.7-2.3
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking
- affected < 3.2.7-2.3fixed 3.2.7-2.3
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr
- affected < 3.2.7-2.3fixed 3.2.7-2.3
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a
- affected < 3.2.7-2.3fixed 3.2.7-2.3
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si
- affected < 3.2.7-2.3fixed 3.2.7-2.3
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
- affected < 3.2.7-2.3fixed 3.2.7-2.3
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh
- affected < 3.2.7-2.3fixed 3.2.7-2.3
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
- affected < 1.10.4-1.1fixed 1.10.4-1.1
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
- affected < 1.10.4-1.1fixed 1.10.4-1.1
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de
- CVE-2015-5963Aug 24, 2015affected < 1.9.12-1.1fixed 1.9.12-1.1
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of reque
- CVE-2015-5145Jul 14, 2015affected < 1.9.12-1.1fixed 1.9.12-1.1
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
- CVE-2015-3982Jun 2, 2015affected < 1.9.12-1.1fixed 1.9.12-1.1
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Page 5 of 5