The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.

python Django was updated to fix a remote denial of service (resource exhaustion) possibility in the auth views module. (bsc#941587, CVE-2015-5963)

Also is_safe_url() was made to reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)

  - Method check_for_test_cookie is deprecated, bnc#914706

  - Update to version 1.5.12 with various security fixes :

  + Fixed a regression with dynamically generated inlines     and allowed field references in the admin

  + Allowed related many-to-many fields to be referenced in     the admin

  + Allowed inline and hidden references to admin fields

python-django was updated to 1.6.11 to fix security issues and non-security bugs.

THe following vulnerabilities were fixed :

  - Made is_safe_url() reject URLs that start with control     characters to mitigate possible XSS attack via     user-supplied redirect URLs (bnc#923176, CVE-2015-2317)

  - Fixed an infinite loop possibility in strip_tags()     (bnc#923172, CVE-2015-2316)

  - WSGI header spoofing via underscore/dash conflation     (bnc#913053, CVE-2015-0219)

  - Mitigated possible XSS attack via user-supplied redirect     URLs

  - Denial-of-service attack against     ``django.views.static.serve`` (bnc#913056,     CVE-2015-0221)

  - Database denial-of-service with     ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)

The update also contains fixes for non-security bugs, functional and stability issues.

Updated python-django packages fix security vulnerabilities :

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. Note that this issue only affected python-django (CVE-2015-0222).

Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a \@property (CVE-2015-2241).

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string (CVE-2015-2316).

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL (CVE-2015-2317).

Multiple security issues have been found in Django:
https://www.djangoproject.com/weblog/2015/jan/13/security/

For Debian 6 Squeeeze, they have been fixed in version 1.2.3-3+squeeze12 of python-django. Here is what the upstream developers have to say about those issues :

CVE-2015-0219 - WSGI header spoofing via underscore/dash conflation

When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending HTTP_. For instance, a header X-Auth-User would become HTTP_X_AUTH_USER in the WSGI environ (and thus also in Django's request.META dictionary).

Unfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: X-Auth-User and X-Auth_User both become HTTP_X_AUTH_USER. This means that if a header is used in a security-sensitive way (for instance, passing authentication information along from a front-end proxy), even if the proxy carefully strips any incoming value for X-Auth-User, an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection.

In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is not recommended for production use, but matching the behavior of common production servers reduces the surface area for behavior changes during deployment.

CVE-2015-0220 - Possible XSS attack via user-supplied redirect URLs

Django relies on user input in some cases (e.g.
django.contrib.auth.views.login() and i18n) to redirect the user to an 'on success' URL. The security checks for these redirects (namely django.util.http.is_safe_url()) didn't strip leading whitespace on the tested URL and as such considered URLs like '\njavascript:...' safe.
If a developer relied on is_safe_url() to provide safe redirect targets and put such a URL into a link, they could suffer from a XSS attack. This bug doesn't affect Django currently, since we only put this URL into the Location response header and browsers seem to ignore JavaScript there.

CVE-2015-0221 - denial of service attack against django.views.static.serve

In older versions of Django, the django.views.static.serve() view read the files it served one line at a time. Therefore, a big file with no newlines would result in memory usage equal to the size of that file.
An attacker could exploit this and launch a denial of service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage.

Note, however, that this view has always carried a warning that it is not hardened for production use and should be used only as a development aid. Now may be a good time to audit your project and serve your files in production using a real front-end web server if you are not doing so.

Note that the version of Django in use in Debian 6 Squeeze was not affected by CVE-2015-0222 (Database denial of service with ModelMultipleChoiceField) since that feature does not exist in this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated python-django packages fix security vulnerabilities :

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments (CVE-2015-0219).

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack (CVE-2015-0220).

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service (CVE-2015-0221).

USN-2469-1 fixed vulnerabilities in Django. The security fix for CVE-2015-0221 introduced a regression on Ubuntu 10.04 LTS and Ubuntu 12.04 LTS when serving static content through GZipMiddleware. This update fixes the problem.

We apologize for the inconvenience.

Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments. (CVE-2015-0219)

Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker could possibly use this issue to perform a cross-site scripting attack. (CVE-2015-0220)

Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service.
(CVE-2015-0221)

Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10.
(CVE-2015-0222).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Django, a high-level Python web development framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-0219     Jedediah Smith reported that the WSGI environ in Django     does not distinguish between headers containing dashes     and headers containing underscores. A remote attacker     could use this flaw to spoof WSGI headers.

  - CVE-2015-0220     Mikko Ohtamaa discovered that the     django.util.http.is_safe_url() function in Django does     not properly handle leading whitespaces in user-supplied     redirect URLs. A remote attacker could potentially use     this flaw to perform a cross-site scripting attack.

  - CVE-2015-0221     Alex Gaynor reported a flaw in the way Django handles     reading files in the django.views.static.serve() view. A     remote attacker could possibly use this flaw to mount a     denial of service via resource consumption.

update to 1.4.18 fixing multiple CVEs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix CVE-2015-0219 (rhbz#1181939)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Django project reports :

Today the Django team is issuing multiple releases -- Django 1.4.18, Django 1.6.10, and Django 1.7.3 -- as part of our security process.
These releases are now available on PyPI and our download page.

These releases address several security issues. We encourage all users of Django to upgrade as soon as possible.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2469-1 advisory.

    Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker     could possibly use this issue to spoof headers in certain environments. (CVE-2015-0219)

    Mikko Ohtamaa discovered that Django incorrectly handled user-supplied redirect URLs. A remote attacker     could possibly use this issue to perform a cross-site scripting attack. (CVE-2015-0220)

    Alex Gaynor discovered that Django incorrectly handled reading files in django.views.static.serve(). A     remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial     of service. (CVE-2015-0221)

    Keryn Knight discovered that Django incorrectly handled forms with ModelMultipleChoiceField. A remote     attacker could possibly use this issue to cause a large number of SQL queries, resulting in a database     denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-0222)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
86091	openSUSE Security Update : python-django (openSUSE-2015-598)	Nessus	SuSE Local Security Checks	medium
82515	openSUSE Security Update : python-Django (openSUSE-2015-281)	Nessus	SuSE Local Security Checks	medium
82362	Mandriva Linux Security Advisory : python-django (MDVSA-2015:109)	Nessus	Mandriva Local Security Checks	medium
82126	Debian DLA-143-1 : python-django security update	Nessus	Debian Local Security Checks	medium
81236	Mandriva Linux Security Advisory : python-django (MDVSA-2015:036)	Nessus	Mandriva Local Security Checks	medium
81177	Ubuntu 10.04 LTS / 12.04 LTS : python-django regression (USN-2469-2)	Nessus	Ubuntu Local Security Checks	medium
81131	Debian DSA-3151-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
81008	Fedora 20 : python-django14-1.4.18-1.fc20 (2015-0804)	Nessus	Fedora Local Security Checks	medium
81007	Fedora 20 : python-django-1.6.10-1.fc20 (2015-0790)	Nessus	Fedora Local Security Checks	medium
80983	FreeBSD : django -- multiple vulnerabilities (9c7b6c20-a324-11e4-879c-00e0814cab4e)	Nessus	FreeBSD Local Security Checks	medium
80975	Fedora 21 : python-django-1.6.10-1.fc21 (2015-0714)	Nessus	Fedora Local Security Checks	medium
80516	Ubuntu 14.04 LTS : Django vulnerabilities (USN-2469-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-0221

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium