The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0129 advisory.

    Django is a high-level Python Web framework that encourages rapid     development and a clean, pragmatic design. It focuses on automating as much     as possible and adhering to the DRY (Don't Repeat Yourself) principle.

    An information-exposure flaw was found in the Django date filter. If an     application allowed users to provide non-validated date formats, a     malicious end user could expose application-settings data by providing     the relevant applications-settings key instead of a valid date format.
    (CVE-2015-8213)

    Red Hat would like to thank the Django project for reporting this issue.
    Upstream acknowledges Ryan Butterfield as the original reporter.

    All python-django users are advised to upgrade to these updated packages,     which contain backported patches to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes CVE-2015-8213: Fixed settings leak possibility in date template filter, more info can be found https://www.djangoproject.com/weblog/2015/nov/24/security-releases-iss ued/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.8.7 , fixing CVE-2015-8213 (rhbz#1285278) ---- python- django-1.8.4-1.fc22 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of-service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial- of-service possibility in logout() view by filling session store (rhbz#1252891) python-django-1.8.4-1.fc23 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of- service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial-of-service possibility in logout() view by filling session store (rhbz#1252891)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The python-Django package was updated to fix the following security issue :

  - CVE-2015-8213: Fixed a problem to prevent settings leak     in date template filter (bnc#955412).

The python-django package was updated to fix the following security issue :

  - CVE-2015-8213: Fixed a problem to prevent settings leak     in date template filter (bnc#955412)

Tim Graham reports :

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. 'SECRET_KEY' instead of 'j/m/Y'.

Ryan Butterfield discovered a vulnerability in the date template filter in python-django, a high-level Python web development framework. A remote attacker can take advantage of this flaw to obtain any secret in the application's settings.

It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework.

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. 'SECRET_KEY' instead of 'j/m/Y'.

To remedy this, the underlying function used by the date template filter, django.utils.formats.get_format(), now only allows accessing the date/time formatting settings.

For Debian 6 Squeeze, this issue has been fixed in python-django version 1.2.3-3+squeeze15.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2816-1 advisory.

    Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker     could possibly use this issue to obtain secrets from application settings.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210213	RHEL 7 : python-django (RHSA-2016:0129)	Nessus	Red Hat Local Security Checks	medium
89358	Fedora 23 : python-django-1.8.7-1.fc23 (2015-a8c8f60fbd)	Nessus	Fedora Local Security Checks	medium
89201	Fedora 22 : python-django-1.8.7-1.fc22 (2015-323274d412)	Nessus	Fedora Local Security Checks	medium
87439	openSUSE Security Update : python-Django (openSUSE-2015-862)	Nessus	SuSE Local Security Checks	medium
87438	openSUSE Security Update : python-django (openSUSE-2015-860)	Nessus	SuSE Local Security Checks	medium
87114	FreeBSD : django -- information leak vulnerability (11c52bc6-97aa-11e5-b8df-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
87077	Debian DSA-3404-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
87070	Debian DLA-349-1 : python-django security update	Nessus	Debian Local Security Checks	medium
87065	Ubuntu 14.04 LTS : Django vulnerability (USN-2816-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-8213

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium