Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python-django: DNS rebinding vulnerability when 'DEBUG=True' (CVE-2016-9014)

  - Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect     regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response     splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the     URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
    (CVE-2015-5144)

  - Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to     redirect the user to an on success URL. The security check for these redirects (namely     ``django.utils.http.is_safe_url()``) considered some numeric URLs safe when they shouldn't be, aka an     open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect     targets and puts such a URL into a link, they could suffer from an XSS attack. (CVE-2017-7233)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

rebase to 1.8.6 (rhbz#1276914) ---- rebase to 1.8.5 (rhbz#1276914)
---- python-django-1.8.4-1.fc23 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of-service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial-of-service possibility in logout() view by filling session store (rhbz#1252891)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201510-06 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Django:
      Session backends create a new record anytime request.session was         accessed (CVE-2015-5143)       Built-in validators in Django do not properly sanitize input         (CVE-2015-5144)       URL validation included a regular expression that was extremely slow         (CVE-2015-5145)   Impact :

    A remote attacker may be able cause a Denial of Service condition,       inject arbitrary headers, and conduct HTTP response splitting attacks.
  Workaround :

    There is no known workaround at this time.

python-django was updated to fix two security issues.

These security issues were fixed :

  - CVE-2015-5144: Django before 1.4.21, 1.5.x through     1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used     an incorrect regular expression, which allowed remote     attackers to inject arbitrary headers and conduct HTTP     response splitting attacks via a newline character in an     (1) email message to the EmailValidator, a (2) URL to     the URLValidator, or unspecified vectors to the (3)     validate_ipv4_address or (4) validate_slug validator     (bsc#937523).

  - CVE-2015-5143: The session backends in Django before     1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and     1.8.x before 1.8.3 allowed remote attackers to cause a     denial of service (session store consumption) via     multiple requests with unique session keys (bsc#937522).

update to 1.8.3 fixing 3 CVE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Django, a high-level Python web development framework :

CVE-2015-2317

Daniel Chatfield discovered that python-django, a high-level Python web development framework, incorrectly handled user-supplied redirect URLs. A remote attacker could use this flaw to perform a cross-site scripting attack.

CVE-2015-5143

Eric Peterson and Lin Hua Cheng discovered that a new empty record used to be created in the session storage every time a session was accessed and an unknown session key was provided in the request cookie. This could allow remote attackers to saturate the session store or cause other users' session records to be evicted.

CVE-2015-5144

Sjoerd Job Postmus discovered that some built-in validators did not properly reject newlines in input values. This could allow remote attackers to inject headers in emails and HTTP responses.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 1.2.3-3+squeeze13.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2671-1 advisory.

    Eric Peterson and Lin Hua Cheng discovered that Django incorrectly handled session records. A remote     attacker could use this issue to cause a denial of service. (CVE-2015-5143)

    Sjoerd Job Postmus discovered that DJango incorrectly handled newline characters when performing     validation. A remote attacker could use this issue to perform header injection attacks. (CVE-2015-5144)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tim Graham reports :

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

Several vulnerabilities were discovered in Django, a high-level Python web development framework :

  - CVE-2015-5143     Eric Peterson and Lin Hua Cheng discovered that a new     empty record used to be created in the session storage     every time a session was accessed and an unknown session     key was provided in the request cookie. This could allow     remote attackers to saturate the session store or cause     other users' session records to be evicted.

  - CVE-2015-5144     Sjoerd Job Postmus discovered that some built-in     validators did not properly reject newlines in input     values. This could allow remote attackers to inject     headers in emails and HTTP responses.

ID	Name	Product	Family	Severity
198748	RHEL 6 : django (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
89168	Fedora 23 : python-django-1.8.6-1.fc23 (2015-1dd5bc998f)	Nessus	Fedora Local Security Checks	high
86691	GLSA-201510-06 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
86594	openSUSE Security Update : python-Django (openSUSE-2015-677)	Nessus	SuSE Local Security Checks	high
86555	openSUSE Security Update : python-django (openSUSE-2015-674)	Nessus	SuSE Local Security Checks	high
84968	Fedora 22 : python-django-1.8.3-1.fc22 (2015-11403)	Nessus	Fedora Local Security Checks	high
84812	Debian DLA-272-1 : python-django security update	Nessus	Debian Local Security Checks	high
84665	Ubuntu 14.04 LTS : Django vulnerabilities (USN-2671-1)	Nessus	Ubuntu Local Security Checks	medium
84652	FreeBSD : django -- multiple vulnerabilities (37ed8e9c-2651-11e5-86ff-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
84626	Debian DSA-3305-1 : python-django - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-5144

medium

Tenable Plugins

high

high

high

high

high

high

high

medium

high

high