rpm package
suse/python-Django&distro=SUSE OpenStack Cloud 6
pkg:rpm/suse/python-Django&distro=SUSE%20OpenStack%20Cloud%206
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-7537 | Med | 5.3 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking | |
| CVE-2018-7536 | Med | 5.3 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr | |
| CVE-2017-12794 | Med | 6.1 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Sep 7, 2017 | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si | |
| CVE-2017-7234 | Med | 6.1 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Apr 4, 2017 | A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. | |
| CVE-2017-7233 | Med | 6.1 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Apr 4, 2017 | Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh | |
| CVE-2016-9014 | Hig | 8.1 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Dec 9, 2016 | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. | |
| CVE-2016-9013 | Cri | 9.8 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Dec 9, 2016 | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging fa | |
| CVE-2016-7401 | Hig | 7.5 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Oct 3, 2016 | The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. | |
| CVE-2016-2512 | Hig | 7.4 | < 1.8.19-3.6.1 | 1.8.19-3.6.1 | Apr 8, 2016 | The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de |
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging fa
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
- affected < 1.8.19-3.6.1fixed 1.8.19-3.6.1
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de