Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2015-8213 (GCVE-0-2015-8213)
Vulnerability from cvelistv5
Published
2015-12-07 20:00
Modified
2024-08-06 08:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:13:31.831Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"name": "openSUSE-SU-2015:2199",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"name": "USN-2816-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"name": "RHSA-2016:0129",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"name": "FEDORA-2015-323274d412",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"name": "1034237",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034237"
},
{
"name": "RHSA-2016:0158",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"name": "RHSA-2016:0157",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"name": "DSA-3404",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"name": "RHSA-2016:0156",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"name": "77750",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/77750"
},
{
"name": "FEDORA-2015-a8c8f60fbd",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"name": "openSUSE-SU-2015:2202",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-11-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"name": "openSUSE-SU-2015:2199",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"name": "USN-2816-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"name": "RHSA-2016:0129",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"name": "FEDORA-2015-323274d412",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"name": "1034237",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034237"
},
{
"name": "RHSA-2016:0158",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"name": "RHSA-2016:0157",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"name": "DSA-3404",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"name": "RHSA-2016:0156",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"name": "77750",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/77750"
},
{
"name": "FEDORA-2015-a8c8f60fbd",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"name": "openSUSE-SU-2015:2202",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8213",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4",
"refsource": "CONFIRM",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"name": "openSUSE-SU-2015:2199",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"name": "USN-2816-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"name": "RHSA-2016:0129",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"name": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"refsource": "CONFIRM",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"name": "FEDORA-2015-323274d412",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"name": "1034237",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"name": "RHSA-2016:0158",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"name": "RHSA-2016:0157",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"name": "DSA-3404",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"name": "RHSA-2016:0156",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"name": "77750",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"name": "FEDORA-2015-a8c8f60fbd",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"name": "openSUSE-SU-2015:2202",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8213",
"datePublished": "2015-12-07T20:00:00",
"dateReserved": "2015-11-14T00:00:00",
"dateUpdated": "2024-08-06T08:13:31.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2015-8213\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2015-12-07T20:59:17.613\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n get_format en utils/formats.py en Django en versiones anteriores a 1.7.x en versiones anteriores a 1.7.11, 1.8.x en versiones anteriores a 1.8.7 y 1.9.x en versiones anteriores a 1.9rc2 puede permitir a atacantes remotos obtener secretos sensibles de aplicaciones a trav\u00e9s de una clave de ajustes en lugar de un ajuste de formato de fecha/hora, seg\u00fan lo demostrado por SECRET_KEY.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.7.10\",\"matchCriteriaId\":\"BDD6D743-BCFB-49E9-A287-8E36E6E619D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02D3C0FF-C342-40F1-A187-CD212C16FE8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1B388C7-ED4E-4416-969F-32263E7D7AA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63D36984-4C8E-4CDB-8D15-445705FCECF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B324AE6-ADD8-41B9-B250-A6577ACBB364\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6487058-6768-4AD3-BE27-A0B3D1ACFC08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CFF0538-B111-44A8-ADC2-87E280186257\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"832F9FA9-5FC8-4DB6-AD39-C3D1C21C4568\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0129.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0156.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0157.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0158.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3404\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/77750\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1034237\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2816-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0129.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0156.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0157.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-0158.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2015/dsa-3404\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/77750\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1034237\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2816-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
rhsa-2016_0129
Vulnerability from csaf_redhat
Published
2016-02-08 06:50
Modified
2024-11-14 17:19
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0129",
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0129.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2024-11-14T17:19:28+00:00",
"generator": {
"date": "2024-11-14T17:19:28+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2016:0129",
"initial_release_date": "2016-02-08T06:50:15+00:00",
"revision_history": [
{
"date": "2016-02-08T06:50:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-08T06:50:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T17:19:28+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-08T06:50:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016:0360
Vulnerability from csaf_redhat
Published
2016-03-08 06:35
Modified
2025-09-10 14:11
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational
Tools.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational\nTools.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0360",
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0360.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:11:08+00:00",
"generator": {
"date": "2025-09-10T14:11:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0360",
"initial_release_date": "2016-03-08T06:35:15+00:00",
"revision_history": [
{
"date": "2016-03-08T06:35:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-03-08T06:35:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:11:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack-optools:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-03-08T06:35:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016_0157
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2024-11-14 17:19
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0157",
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0157.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2024-11-14T17:19:24+00:00",
"generator": {
"date": "2024-11-14T17:19:24+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2016:0157",
"initial_release_date": "2016-02-10T01:15:56+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T17:19:24+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:56+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016_0360
Vulnerability from csaf_redhat
Published
2016-03-08 06:35
Modified
2024-11-14 17:19
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational
Tools.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational\nTools.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0360",
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0360.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2024-11-14T17:19:38+00:00",
"generator": {
"date": "2024-11-14T17:19:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2016:0360",
"initial_release_date": "2016-03-08T06:35:15+00:00",
"revision_history": [
{
"date": "2016-03-08T06:35:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-03-08T06:35:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T17:19:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack-optools:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-03-08T06:35:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016:0156
Vulnerability from csaf_redhat
Published
2016-02-10 01:16
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0156",
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0156.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:45+00:00",
"generator": {
"date": "2025-09-10T14:10:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0156",
"initial_release_date": "2016-02-10T01:16:06+00:00",
"revision_history": [
{
"date": "2016-02-10T01:16:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:16:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.src",
"product": {
"name": "python-django-0:1.8.7-1.el7.src",
"product_id": "python-django-0:1.8.7-1.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_id": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-0:1.8.7-1.el7.noarch",
"product_id": "python-django-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_id": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.8.7-1.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src"
},
"product_reference": "python-django-0:1.8.7-1.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-doc-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:16:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016_0156
Vulnerability from csaf_redhat
Published
2016-02-10 01:16
Modified
2024-11-14 17:19
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0156",
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0156.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2024-11-14T17:19:33+00:00",
"generator": {
"date": "2024-11-14T17:19:33+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2016:0156",
"initial_release_date": "2016-02-10T01:16:06+00:00",
"revision_history": [
{
"date": "2016-02-10T01:16:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:16:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T17:19:33+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.src",
"product": {
"name": "python-django-0:1.8.7-1.el7.src",
"product_id": "python-django-0:1.8.7-1.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_id": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-0:1.8.7-1.el7.noarch",
"product_id": "python-django-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_id": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.8.7-1.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src"
},
"product_reference": "python-django-0:1.8.7-1.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-doc-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:16:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016_0158
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2024-11-14 17:19
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0158",
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0158.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2024-11-14T17:19:19+00:00",
"generator": {
"date": "2024-11-14T17:19:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.0"
}
},
"id": "RHSA-2016:0158",
"initial_release_date": "2016-02-10T01:15:47+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T17:19:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.src",
"product_id": "python-django-0:1.6.11-4.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:47+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
RHSA-2016:0157
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0157",
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0157.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:46+00:00",
"generator": {
"date": "2025-09-10T14:10:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0157",
"initial_release_date": "2016-02-10T01:15:56+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:56+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016:0158
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0158",
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0158.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:46+00:00",
"generator": {
"date": "2025-09-10T14:10:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0158",
"initial_release_date": "2016-02-10T01:15:47+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.src",
"product_id": "python-django-0:1.6.11-4.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:47+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
RHSA-2016:0156
Vulnerability from csaf_redhat
Published
2016-02-10 01:16
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0156",
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0156.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:45+00:00",
"generator": {
"date": "2025-09-10T14:10:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0156",
"initial_release_date": "2016-02-10T01:16:06+00:00",
"revision_history": [
{
"date": "2016-02-10T01:16:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:16:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.src",
"product": {
"name": "python-django-0:1.8.7-1.el7.src",
"product_id": "python-django-0:1.8.7-1.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_id": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-0:1.8.7-1.el7.noarch",
"product_id": "python-django-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.8.7-1.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_id": "python-django-doc-0:1.8.7-1.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.8.7-1.el7?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.8.7-1.el7.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src"
},
"product_reference": "python-django-0:1.8.7-1.el7.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-bash-completion-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.8.7-1.el7.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
},
"product_reference": "python-django-doc-0:1.8.7-1.el7.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:16:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0156"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-0:1.8.7-1.el7.src",
"7Server-RH7-RHOS-7.0:python-django-bash-completion-0:1.8.7-1.el7.noarch",
"7Server-RH7-RHOS-7.0:python-django-doc-0:1.8.7-1.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
RHSA-2016:0129
Vulnerability from csaf_redhat
Published
2016-02-08 06:50
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0129",
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0129.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:44+00:00",
"generator": {
"date": "2025-09-10T14:10:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0129",
"initial_release_date": "2016-02-08T06:50:15+00:00",
"revision_history": [
{
"date": "2016-02-08T06:50:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-08T06:50:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-08T06:50:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016:0129
Vulnerability from csaf_redhat
Published
2016-02-08 06:50
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0129",
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0129.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:44+00:00",
"generator": {
"date": "2025-09-10T14:10:44+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0129",
"initial_release_date": "2016-02-08T06:50:15+00:00",
"revision_history": [
{
"date": "2016-02-08T06:50:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-08T06:50:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:44+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
"product_id": "7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-6.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-08T06:50:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0129"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-6.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-6.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
RHSA-2016:0158
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 6.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0158",
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0158.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:46+00:00",
"generator": {
"date": "2025-09-10T14:10:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0158",
"initial_release_date": "2016-02-10T01:15:47+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:48+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.src",
"product_id": "python-django-0:1.6.11-4.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el6ost.noarch",
"product_id": "python-django-0:1.6.11-4.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el6ost.src",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
"product_id": "6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el6ost.noarch",
"relates_to_product_reference": "6Server-RH6-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:47+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-0:1.6.11-4.el6ost.src",
"6Server-RH6-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el6ost.noarch",
"6Server-RH6-RHOS-5.0:python-django-doc-0:1.6.11-4.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
RHSA-2016:0360
Vulnerability from csaf_redhat
Published
2016-03-08 06:35
Modified
2025-09-10 14:11
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational
Tools.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational\nTools.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0360",
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0360.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:11:08+00:00",
"generator": {
"date": "2025-09-10T14:11:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0360",
"initial_release_date": "2016-03-08T06:35:15+00:00",
"revision_history": [
{
"date": "2016-03-08T06:35:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-03-08T06:35:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:11:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack-optools:7::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7",
"product_id": "7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-7.0-OPTOOLS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-03-08T06:35:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0360"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-7.0-OPTOOLS:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
rhsa-2016:0157
Vulnerability from csaf_redhat
Published
2016-02-10 01:15
Modified
2025-09-10 14:10
Summary
Red Hat Security Advisory: python-django security update
Notes
Topic
Updated python-django packages that fix one security issue are now
available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat
Enterprise Linux 7.
Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Django is a high-level Python Web framework that encourages rapid
development and a clean, pragmatic design. It focuses on automating as much
as possible and adhering to the DRY (Don't Repeat Yourself) principle.
An information-exposure flaw was found in the Django date filter. If an
application allowed users to provide non-validated date formats, a
malicious end user could expose application-settings data by providing
the relevant applications-settings key instead of a valid date format.
(CVE-2015-8213)
Red Hat would like to thank the Django project for reporting this issue.
Upstream acknowledges Ryan Butterfield as the original reporter.
All python-django users are advised to upgrade to these updated packages,
which contain backported patches to correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated python-django packages that fix one security issue are now\navailable for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat\nEnterprise Linux 7.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Django is a high-level Python Web framework that encourages rapid\ndevelopment and a clean, pragmatic design. It focuses on automating as much\nas possible and adhering to the DRY (Don\u0027t Repeat Yourself) principle.\n\nAn information-exposure flaw was found in the Django date filter. If an\napplication allowed users to provide non-validated date formats, a\nmalicious end user could expose application-settings data by providing\nthe relevant applications-settings key instead of a valid date format. \n(CVE-2015-8213)\n\nRed Hat would like to thank the Django project for reporting this issue.\nUpstream acknowledges Ryan Butterfield as the original reporter.\n\nAll python-django users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct this issue.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:0157",
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0157.json"
}
],
"title": "Red Hat Security Advisory: python-django security update",
"tracking": {
"current_release_date": "2025-09-10T14:10:46+00:00",
"generator": {
"date": "2025-09-10T14:10:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:0157",
"initial_release_date": "2016-02-10T01:15:56+00:00",
"revision_history": [
{
"date": "2016-02-10T01:15:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-02-10T01:15:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:10:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:5::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-doc@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django-bash-completion@1.6.11-4.el7ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.noarch",
"product_id": "python-django-0:1.6.11-4.el7ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "python-django-0:1.6.11-4.el7ost.src",
"product": {
"name": "python-django-0:1.6.11-4.el7ost.src",
"product_id": "python-django-0:1.6.11-4.el7ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-django@1.6.11-4.el7ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-0:1.6.11-4.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src"
},
"product_reference": "python-django-0:1.6.11-4.el7ost.src",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-django-doc-0:1.6.11-4.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
"product_id": "7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
},
"product_reference": "python-django-doc-0:1.6.11-4.el7ost.noarch",
"relates_to_product_reference": "7Server-RH7-RHOS-5.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Django project"
]
},
{
"names": [
"Ryan Butterfield"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-8213",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2015-11-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1283553"
}
],
"notes": [
{
"category": "description",
"text": "An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Information leak through date template filter",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "RHBZ#1283553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8213",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8213"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"release_date": "2015-11-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-02-10T01:15:56+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:0157"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-0:1.6.11-4.el7ost.src",
"7Server-RH7-RHOS-5.0:python-django-bash-completion-0:1.6.11-4.el7ost.noarch",
"7Server-RH7-RHOS-5.0:python-django-doc-0:1.6.11-4.el7ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Information leak through date template filter"
}
]
}
suse-su-2015:2327-1
Vulnerability from csaf_suse
Published
2015-12-19 11:25
Modified
2015-12-19 11:25
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
This update for python-Django fixes the following issues:
- Add 0004-1.6.x-fixed-a-settings-leak-possibility-in-the-date-.patch
to prevent settings leak in date template filter (bsc#955412, CVE-2015-8213)
Patchnames
SUSE-Storage-1.0-2015-998
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for python-Django fixes the following issues: \n\n- Add 0004-1.6.x-fixed-a-settings-leak-possibility-in-the-date-.patch\n to prevent settings leak in date template filter (bsc#955412, CVE-2015-8213)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-Storage-1.0-2015-998",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_2327-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2015:2327-1",
"url": "https://www.suse.com/support/update/announcement/2015/suse-su-20152327-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2015:2327-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2015-December/001746.html"
},
{
"category": "self",
"summary": "SUSE Bug 955412",
"url": "https://bugzilla.suse.com/955412"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8213 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8213/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2015-12-19T11:25:20Z",
"generator": {
"date": "2015-12-19T11:25:20Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2015:2327-1",
"initial_release_date": "2015-12-19T11:25:20Z",
"revision_history": [
{
"date": "2015-12-19T11:25:20Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-11.1.noarch",
"product": {
"name": "python-Django-1.6.11-11.1.noarch",
"product_id": "python-Django-1.6.11-11.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Enterprise Storage 1.0",
"product": {
"name": "SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:1.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-11.1.noarch as component of SUSE Enterprise Storage 1.0",
"product_id": "SUSE Enterprise Storage 1.0:python-Django-1.6.11-11.1.noarch"
},
"product_reference": "python-Django-1.6.11-11.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 1.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-8213",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8213"
}
],
"notes": [
{
"category": "general",
"text": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-11.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8213",
"url": "https://www.suse.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "SUSE Bug 955412 for CVE-2015-8213",
"url": "https://bugzilla.suse.com/955412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 1.0:python-Django-1.6.11-11.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2015-12-19T11:25:20Z",
"details": "moderate"
}
],
"title": "CVE-2015-8213"
}
]
}
suse-su-2016:0040-1
Vulnerability from csaf_suse
Published
2016-01-07 09:00
Modified
2016-01-07 09:00
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
This update for python-Django fixes the following issues:
- Prevent settings leak in date template filter. (bsc#955412, CVE-2015-8213)
Patchnames
sleclo50sp3-python-Django-12302
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis update for python-Django fixes the following issues: \n\n- Prevent settings leak in date template filter. (bsc#955412, CVE-2015-8213)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleclo50sp3-python-Django-12302",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0040-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:0040-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20160040-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:0040-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-January/001782.html"
},
{
"category": "self",
"summary": "SUSE Bug 955412",
"url": "https://bugzilla.suse.com/955412"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8213 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8213/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2016-01-07T09:00:29Z",
"generator": {
"date": "2016-01-07T09:00:29Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:0040-1",
"initial_release_date": "2016-01-07T09:00:29Z",
"revision_history": [
{
"date": "2016-01-07T09:00:29Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-13.1.x86_64",
"product": {
"name": "python-Django-1.6.11-13.1.x86_64",
"product_id": "python-Django-1.6.11-13.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 5",
"product": {
"name": "SUSE OpenStack Cloud 5",
"product_id": "SUSE OpenStack Cloud 5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:cloud:5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-13.1.x86_64 as component of SUSE OpenStack Cloud 5",
"product_id": "SUSE OpenStack Cloud 5:python-Django-1.6.11-13.1.x86_64"
},
"product_reference": "python-Django-1.6.11-13.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-8213",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8213"
}
],
"notes": [
{
"category": "general",
"text": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-13.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8213",
"url": "https://www.suse.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "SUSE Bug 955412 for CVE-2015-8213",
"url": "https://bugzilla.suse.com/955412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE OpenStack Cloud 5:python-Django-1.6.11-13.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T09:00:29Z",
"details": "moderate"
}
],
"title": "CVE-2015-8213"
}
]
}
suse-su-2016:0044-1
Vulnerability from csaf_suse
Published
2016-01-07 11:04
Modified
2016-01-07 11:04
Summary
Security update for python-Django
Notes
Title of the patch
Security update for python-Django
Description of the patch
This update fixes the following security issues:
- (bnc#955412, CVE-2015-8213) Possible settings leak in date template filter
- (bnc#937522, CVE-2015-5143) Possible denial-of-service in session store
- (bnc#937523, CVE-2015-5144) Possible Header injection
- (bnc#941587, CVE-2015-5963) Possible denial-of-service by filling session store via logout()
Patchnames
SUSE-Storage-2-2016-35
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Django",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\n\nThis update fixes the following security issues:\n\n\n- (bnc#955412, CVE-2015-8213) Possible settings leak in date template filter \n\n- (bnc#937522, CVE-2015-5143) Possible denial-of-service in session store\n\n- (bnc#937523, CVE-2015-5144) Possible Header injection\n\n- (bnc#941587, CVE-2015-5963) Possible denial-of-service by filling session store via logout()\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-Storage-2-2016-35",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0044-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2016:0044-1",
"url": "https://www.suse.com/support/update/announcement/2016/suse-su-20160044-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2016:0044-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2016-January/001786.html"
},
{
"category": "self",
"summary": "SUSE Bug 937522",
"url": "https://bugzilla.suse.com/937522"
},
{
"category": "self",
"summary": "SUSE Bug 937523",
"url": "https://bugzilla.suse.com/937523"
},
{
"category": "self",
"summary": "SUSE Bug 941587",
"url": "https://bugzilla.suse.com/941587"
},
{
"category": "self",
"summary": "SUSE Bug 955412",
"url": "https://bugzilla.suse.com/955412"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5143 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5143/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5144 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-5963 page",
"url": "https://www.suse.com/security/cve/CVE-2015-5963/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-8213 page",
"url": "https://www.suse.com/security/cve/CVE-2015-8213/"
}
],
"title": "Security update for python-Django",
"tracking": {
"current_release_date": "2016-01-07T11:04:29Z",
"generator": {
"date": "2016-01-07T11:04:29Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2016:0044-1",
"initial_release_date": "2016-01-07T11:04:29Z",
"revision_history": [
{
"date": "2016-01-07T11:04:29Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Django-1.6.11-3.1.noarch",
"product": {
"name": "python-Django-1.6.11-3.1.noarch",
"product_id": "python-Django-1.6.11-3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Enterprise Storage 2",
"product": {
"name": "SUSE Enterprise Storage 2",
"product_id": "SUSE Enterprise Storage 2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Django-1.6.11-3.1.noarch as component of SUSE Enterprise Storage 2",
"product_id": "SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
},
"product_reference": "python-Django-1.6.11-3.1.noarch",
"relates_to_product_reference": "SUSE Enterprise Storage 2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-5143",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5143"
}
],
"notes": [
{
"category": "general",
"text": "The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5143",
"url": "https://www.suse.com/security/cve/CVE-2015-5143"
},
{
"category": "external",
"summary": "SUSE Bug 937522 for CVE-2015-5143",
"url": "https://bugzilla.suse.com/937522"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T11:04:29Z",
"details": "important"
}
],
"title": "CVE-2015-5143"
},
{
"cve": "CVE-2015-5144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5144"
}
],
"notes": [
{
"category": "general",
"text": "Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5144",
"url": "https://www.suse.com/security/cve/CVE-2015-5144"
},
{
"category": "external",
"summary": "SUSE Bug 937523 for CVE-2015-5144",
"url": "https://bugzilla.suse.com/937523"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T11:04:29Z",
"details": "moderate"
}
],
"title": "CVE-2015-5144"
},
{
"cve": "CVE-2015-5963",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-5963"
}
],
"notes": [
{
"category": "general",
"text": "contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-5963",
"url": "https://www.suse.com/security/cve/CVE-2015-5963"
},
{
"category": "external",
"summary": "SUSE Bug 941587 for CVE-2015-5963",
"url": "https://bugzilla.suse.com/941587"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T11:04:29Z",
"details": "moderate"
}
],
"title": "CVE-2015-5963"
},
{
"cve": "CVE-2015-8213",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-8213"
}
],
"notes": [
{
"category": "general",
"text": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-8213",
"url": "https://www.suse.com/security/cve/CVE-2015-8213"
},
{
"category": "external",
"summary": "SUSE Bug 955412 for CVE-2015-8213",
"url": "https://bugzilla.suse.com/955412"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 2:python-Django-1.6.11-3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2016-01-07T11:04:29Z",
"details": "moderate"
}
],
"title": "CVE-2015-8213"
}
]
}
pysec-2015-11
Vulnerability from pysec
Published
2015-12-07 20:59
Modified
2021-09-01 08:35
Details
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Impacted products
| Name | purl | django | pkg:pypi/django |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django",
"purl": "pkg:pypi/django"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "316bc3fc9437c5960c24baceb93c73f1939711e4"
}
],
"repo": "https://github.com/django/django",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.11"
},
{
"introduced": "1.8"
},
{
"fixed": "1.8.7"
},
{
"introduced": "1.9a0"
},
{
"fixed": "1.9rc2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.1",
"1.1.1",
"1.1.2",
"1.1.3",
"1.1.4",
"1.2",
"1.2.1",
"1.2.2",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.3",
"1.3.1",
"1.3.2",
"1.3.3",
"1.3.4",
"1.3.5",
"1.3.6",
"1.3.7",
"1.4",
"1.4.1",
"1.4.10",
"1.4.11",
"1.4.12",
"1.4.13",
"1.4.14",
"1.4.15",
"1.4.16",
"1.4.17",
"1.4.18",
"1.4.19",
"1.4.2",
"1.4.20",
"1.4.21",
"1.4.22",
"1.4.3",
"1.4.4",
"1.4.5",
"1.4.6",
"1.4.7",
"1.4.8",
"1.4.9",
"1.5",
"1.5.1",
"1.5.10",
"1.5.11",
"1.5.12",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.5.6",
"1.5.7",
"1.5.8",
"1.5.9",
"1.6",
"1.6.1",
"1.6.10",
"1.6.11",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7",
"1.7.1",
"1.7.10",
"1.7.2",
"1.7.3",
"1.7.4",
"1.7.5",
"1.7.6",
"1.7.7",
"1.7.8",
"1.7.9",
"1.8",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.8.5",
"1.8.6",
"1.9a1",
"1.9b1",
"1.9rc1"
]
}
],
"aliases": [
"CVE-2015-8213"
],
"details": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"id": "PYSEC-2015-11",
"modified": "2021-09-01T08:35:41.190803Z",
"published": "2015-12-07T20:59:00Z",
"references": [
{
"type": "ARTICLE",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"type": "FIX",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"type": "ADVISORY",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"type": "ADVISORY",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"type": "ADVISORY",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"type": "ADVISORY",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"type": "ADVISORY",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
},
{
"type": "ADVISORY",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
}
]
}
ghsa-6wcr-wcqm-3mfh
Vulnerability from github
Published
2022-05-17 03:25
Modified
2024-09-18 14:37
Severity ?
2.8 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
VLAI Severity ?
Summary
Django settings leak in date template filter
Details
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.7"
},
{
"fixed": "1.7.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.8a1"
},
{
"fixed": "1.8.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.9a1"
},
{
"fixed": "1.9rc2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2015-8213"
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-08T20:49:45Z",
"nvd_published_at": "2015-12-07T20:59:00Z",
"severity": "MODERATE"
},
"details": "The get_format function in `utils/formats.py` in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by `SECRET_KEY`.",
"id": "GHSA-6wcr-wcqm-3mfh",
"modified": "2024-09-18T14:37:17Z",
"published": "2022-05-17T03:25:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8213"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/3ebbda0aef9e7a90ac6208bb8f9bc21228e2c7da"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-11.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django settings leak in date template filter"
}
gsd-2015-8213
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2015-8213",
"description": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"id": "GSD-2015-8213",
"references": [
"https://www.suse.com/security/cve/CVE-2015-8213.html",
"https://www.debian.org/security/2015/dsa-3404",
"https://access.redhat.com/errata/RHSA-2016:0360",
"https://access.redhat.com/errata/RHSA-2016:0158",
"https://access.redhat.com/errata/RHSA-2016:0157",
"https://access.redhat.com/errata/RHSA-2016:0156",
"https://access.redhat.com/errata/RHSA-2016:0129",
"https://ubuntu.com/security/CVE-2015-8213",
"https://advisories.mageia.org/CVE-2015-8213.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2015-8213"
],
"details": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
"id": "GSD-2015-8213",
"modified": "2023-12-13T01:20:03.296451Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8213",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4",
"refsource": "CONFIRM",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"name": "openSUSE-SU-2015:2199",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"name": "USN-2816-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"name": "RHSA-2016:0129",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"name": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"refsource": "CONFIRM",
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"name": "FEDORA-2015-323274d412",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"name": "1034237",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"name": "RHSA-2016:0158",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"name": "RHSA-2016:0157",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"name": "DSA-3404",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"name": "RHSA-2016:0156",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"name": "77750",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"name": "FEDORA-2015-a8c8f60fbd",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"name": "openSUSE-SU-2015:2202",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.7.11||\u003e=1.8.0a,\u003c1.8.7||\u003e=1.9a,\u003c1.9rc2",
"affected_versions": "All versions before 1.7.11, all versions starting from 1.8.0a before 1.8.7, all versions starting from 1.9a before 1.9rc2",
"credit": "Thanks Ryan Butterfield",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-200",
"CWE-937"
],
"date": "2016-12-07",
"description": "If an application allows users to specify an unvalidated format for dates and passes this format to the `date` filter, a malicious user could obtain any secret in the application\u0027s settings by specifying a settings key instead of a date format. e.g. `SECRET_KEY` instead of `j/m/Y`.",
"fixed_versions": [
"1.7.11",
"1.8.7",
"1.9rc2"
],
"identifier": "CVE-2015-8213",
"identifiers": [
"CVE-2015-8213"
],
"not_impacted": "All versions starting from 1.7.11 before 1.8.0a, all versions starting from 1.8.7 before 1.9a, all versions starting from 1.9rc2",
"package_slug": "pypi/Django",
"pubdate": "2015-12-07",
"solution": "Upgrade to versions 1.7.11, 1.8.7, 1.9rc2 or above.",
"title": "Settings leak in date template filter",
"urls": [
"https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
],
"uuid": "c5cb2d0c-2ffc-4cea-b35b-9a84f6843492"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.7.10",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8213"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"name": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4",
"refsource": "CONFIRM",
"tags": [],
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"name": "USN-2816-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"name": "77750",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/77750"
},
{
"name": "RHSA-2016:0156",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"name": "RHSA-2016:0158",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"name": "RHSA-2016:0129",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"name": "RHSA-2016:0157",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"name": "1034237",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1034237"
},
{
"name": "FEDORA-2015-323274d412",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"name": "openSUSE-SU-2015:2202",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
},
{
"name": "DSA-3404",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"name": "FEDORA-2015-a8c8f60fbd",
"refsource": "FEDORA",
"tags": [],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"name": "openSUSE-SU-2015:2199",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2016-12-07T18:26Z",
"publishedDate": "2015-12-07T20:59Z"
}
}
}
cnvd-2015-07865
Vulnerability from cnvd
Title: python-django日期模板过滤器信息泄露漏洞
Description:
Django是开源的Python Web应用开发框架。
python-django的日期模板过滤器存在安全漏洞。远程攻击者利用此漏洞可获取应用设置内的敏感信息。
Severity: 中
Patch Name: python-django日期模板过滤器信息泄露漏洞的补丁
Patch Description:
Django是开源的Python Web应用开发框架。
python-django的日期模板过滤器存在安全漏洞。远程攻击者利用此漏洞可获取应用设置内的敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description:
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
Reference: https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
Impacted products
| Name | ['Django Django', 'Django Django 1.9', 'Django Django \r\n1.8', 'Django Django \r\n 1.7'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2015-8213"
}
},
"description": "Django\u662f\u5f00\u6e90\u7684Python Web\u5e94\u7528\u5f00\u53d1\u6846\u67b6\u3002\r\n\r\npython-django\u7684\u65e5\u671f\u6a21\u677f\u8fc7\u6ee4\u5668\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u53ef\u83b7\u53d6\u5e94\u7528\u8bbe\u7f6e\u5185\u7684\u654f\u611f\u4fe1\u606f\u3002",
"discovererName": "Ryan Butterfield",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2015-07865",
"openTime": "2015-12-01",
"patchDescription": "Django\u662f\u5f00\u6e90\u7684Python Web\u5e94\u7528\u5f00\u53d1\u6846\u67b6\u3002\r\n\r\npython-django\u7684\u65e5\u671f\u6a21\u677f\u8fc7\u6ee4\u5668\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u53ef\u83b7\u53d6\u5e94\u7528\u8bbe\u7f6e\u5185\u7684\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "python-django\u65e5\u671f\u6a21\u677f\u8fc7\u6ee4\u5668\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"Django Django",
"Django Django 1.9",
"Django Django \r\n1.8",
"Django Django \r\n 1.7"
]
},
"referenceLink": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/",
"serverity": "\u4e2d",
"submitTime": "2015-11-30",
"title": "python-django\u65e5\u671f\u6a21\u677f\u8fc7\u6ee4\u5668\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}
fkie_cve-2015-8213
Vulnerability from fkie_nvd
Published
2015-12-07 20:59
Modified
2025-04-12 10:46
Severity ?
Summary
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| djangoproject | django | * | |
| djangoproject | django | 1.8.0 | |
| djangoproject | django | 1.8.1 | |
| djangoproject | django | 1.8.2 | |
| djangoproject | django | 1.8.3 | |
| djangoproject | django | 1.8.4 | |
| djangoproject | django | 1.8.5 | |
| djangoproject | django | 1.8.6 | |
| djangoproject | django | 1.9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BDD6D743-BCFB-49E9-A287-8E36E6E619D6",
"versionEndIncluding": "1.7.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "02D3C0FF-C342-40F1-A187-CD212C16FE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2510BAD7-1FB6-4F6F-A2CC-9DE9AD39B4FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D1B388C7-ED4E-4416-969F-32263E7D7AA8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "63D36984-4C8E-4CDB-8D15-445705FCECF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3B324AE6-ADD8-41B9-B250-A6577ACBB364",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F6487058-6768-4AD3-BE27-A0B3D1ACFC08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.8.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0CFF0538-B111-44A8-ADC2-87E280186257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:1.9.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "832F9FA9-5FC8-4DB6-AD39-C3D1C21C4568",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY."
},
{
"lang": "es",
"value": "La funci\u00f3n get_format en utils/formats.py en Django en versiones anteriores a 1.7.x en versiones anteriores a 1.7.11, 1.8.x en versiones anteriores a 1.8.7 y 1.9.x en versiones anteriores a 1.9rc2 puede permitir a atacantes remotos obtener secretos sensibles de aplicaciones a trav\u00e9s de una clave de ajustes en lugar de un ajuste de formato de fecha/hora, seg\u00fan lo demostrado por SECRET_KEY."
}
],
"id": "CVE-2015-8213",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-12-07T20:59:17.613",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0129.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0156.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0157.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-0158.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3404"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/77750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1034237"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2816-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…