p31829507
/
django
mirror of https://github.com/django/django.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Added a CVE role for Sphinx.

This commit is contained in:
Tim Graham 2016-09-26 15:37:08 -04:00
parent 8d233a2132
commit a46742e738
3 changed files with 258 additions and 201 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/_ext/cve_role.py Normal file
View File

@ -0,0 +1,27 @@
"""
An interpreted text role to link docs to CVE issues. To use: :cve:`XXXXX`
"""
from docutils import nodes, utils
from docutils.parsers.rst import roles
def cve_role(name, rawtext, text, lineno, inliner, options=None, content=None):
if options is None:
options = {}
url_pattern = inliner.document.settings.env.app.config.cve_url
if url_pattern is None:
msg = inliner.reporter.warning("cve not configured: please configure cve_url in conf.py")
prb = inliner.problematic(rawtext, rawtext, msg)
return [prb], [msg]
url = url_pattern % text
roles.set_classes(options)
node = nodes.reference(rawtext, utils.unescape('CVE-%s' % text), refuri=url, **options)
return [node], []
def setup(app):
app.add_config_value('cve_url', None, 'env')
app.add_role('cve', cve_role)
return {'parallel_read_safe': True}

4
docs/conf.py
View File

@ -45,6 +45,7 @@ extensions = [
"sphinx.ext.intersphinx", "sphinx.ext.intersphinx",
"sphinx.ext.viewcode", "sphinx.ext.viewcode",
"ticket_role", "ticket_role",
"cve_role",
] ]
# Spelling check needs an additional module that is not installed by default. # Spelling check needs an additional module that is not installed by default.
@ -376,5 +377,6 @@ epub_cover = ('', 'epub-cover.html')
# If false, no index is generated. # If false, no index is generated.
# epub_use_index = True # epub_use_index = True
# -- ticket options ------------------------------------------------------------ # -- custom extension options --------------------------------------------------
cve_url = 'https://web.nvd.nist.gov/view/vuln/detail?vulnId=%s'
ticket_url = 'https://code.djangoproject.com/ticket/%s' ticket_url = 'https://code.djangoproject.com/ticket/%s'

428
docs/releases/security.txt
View File

@ -37,10 +37,11 @@ Some security issues were handled before Django had a formalized
security process in use. For these, new releases may not have been security process in use. For these, new releases may not have been
issued at the time and CVEs may not have been assigned. issued at the time and CVEs may not have been assigned.
August 16, 2006 - CVE-2007-0404 August 16, 2006 - :cve:`2007-0404`
------------------------------- ----------------------------------
`CVE-2007-0404 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0404&cid=3>`_: Filename validation issue in translation framework. `Full description <https://www.djangoproject.com/weblog/2006/aug/16/compilemessages/>`__ Filename validation issue in translation framework. `Full description
<https://www.djangoproject.com/weblog/2006/aug/16/compilemessages/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -49,10 +50,11 @@ Versions affected
* Django 0.91 `(patch) <https://github.com/django/django/commit/518d406e53>`__ * Django 0.91 `(patch) <https://github.com/django/django/commit/518d406e53>`__
* Django 0.95 `(patch) <https://github.com/django/django/commit/a132d411c6>`__ (released January 21 2007) * Django 0.95 `(patch) <https://github.com/django/django/commit/a132d411c6>`__ (released January 21 2007)
January 21, 2007 - CVE-2007-0405 January 21, 2007 - :cve:`2007-0405`
-------------------------------- -----------------------------------
`CVE-2007-0405 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-0405&cid=3>`_: Apparent "caching" of authenticated user. `Full description <https://www.djangoproject.com/weblog/2007/jan/21/0951/>`__ Apparent "caching" of authenticated user. `Full description
<https://www.djangoproject.com/weblog/2007/jan/21/0951/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -65,10 +67,11 @@ Issues under Django's security process
All other security issues have been handled under versions of Django's All other security issues have been handled under versions of Django's
security process. These are listed below. security process. These are listed below.
October 26, 2007 - CVE-2007-5712 October 26, 2007 - :cve:`2007-5712`
-------------------------------- -----------------------------------
`CVE-2007-5712 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5712&cid=3>`_: Denial-of-service via arbitrarily-large ``Accept-Language`` header. `Full description <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>`__ Denial-of-service via arbitrarily-large ``Accept-Language`` header. `Full
description <https://www.djangoproject.com/weblog/2007/oct/26/security-fix/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -77,10 +80,11 @@ Versions affected
* Django 0.95 `(patch) <https://github.com/django/django/commit/412ed22502e11c50dbfee854627594f0e7e2c234>`__ * Django 0.95 `(patch) <https://github.com/django/django/commit/412ed22502e11c50dbfee854627594f0e7e2c234>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f>`__ * Django 0.96 `(patch) <https://github.com/django/django/commit/7dd2dd08a79e388732ce00e2b5514f15bd6d0f6f>`__
May 14, 2008 - CVE-2008-2302 May 14, 2008 - :cve:`2008-2302`
---------------------------- -------------------------------
`CVE-2008-2302 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2302&cid=3>`_: XSS via admin login redirect. `Full description <https://www.djangoproject.com/weblog/2008/may/14/security/>`__ XSS via admin login redirect. `Full description
<https://www.djangoproject.com/weblog/2008/may/14/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -89,10 +93,11 @@ Versions affected
* Django 0.95 `(patch) <https://github.com/django/django/commit/50ce7fb57d>`__ * Django 0.95 `(patch) <https://github.com/django/django/commit/50ce7fb57d>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7791e5c050>`__ * Django 0.96 `(patch) <https://github.com/django/django/commit/7791e5c050>`__
September 2, 2008 - CVE-2008-3909 September 2, 2008 - :cve:`2008-3909`
--------------------------------- ------------------------------------
`CVE-2008-3909 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3909&cid=3>`_: CSRF via preservation of POST data during admin login. `Full description <https://www.djangoproject.com/weblog/2008/sep/02/security/>`__ CSRF via preservation of POST data during admin login. `Full description
<https://www.djangoproject.com/weblog/2008/sep/02/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -101,10 +106,11 @@ Versions affected
* Django 0.95 `(patch) <https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81>`__ * Django 0.95 `(patch) <https://github.com/django/django/commit/aee48854a164382c655acb9f18b3c06c3d238e81>`__
* Django 0.96 `(patch) <https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e>`__ * Django 0.96 `(patch) <https://github.com/django/django/commit/7e0972bded362bc4b851c109df2c8a6548481a8e>`__
July 28, 2009 - CVE-2009-2659 July 28, 2009 - :cve:`2009-2659`
----------------------------- --------------------------------
`CVE-2009-2659 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2659&cid=3>`_: Directory-traversal in development server media handler. `Full description <https://www.djangoproject.com/weblog/2009/jul/28/security/>`__ Directory-traversal in development server media handler. `Full description
<https://www.djangoproject.com/weblog/2009/jul/28/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -112,10 +118,11 @@ Versions affected
* Django 0.96 `(patch) <https://github.com/django/django/commit/da85d76fd6>`__ * Django 0.96 `(patch) <https://github.com/django/django/commit/da85d76fd6>`__
* Django 1.0 `(patch) <https://github.com/django/django/commit/df7f917b7f>`__ * Django 1.0 `(patch) <https://github.com/django/django/commit/df7f917b7f>`__
October 9, 2009 - CVE-2009-3965 October 9, 2009 - :cve:`2009-3965`
------------------------------- ----------------------------------
`CVE-2009-3965 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3695&cid=3>`_: Denial-of-service via pathological regular expression performance. `Full description <https://www.djangoproject.com/weblog/2009/oct/09/security/>`__ Denial-of-service via pathological regular expression performance. `Full
description <https://www.djangoproject.com/weblog/2009/oct/09/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -123,20 +130,22 @@ Versions affected
* Django 1.0 `(patch) <https://github.com/django/django/commit/594a28a904>`__ * Django 1.0 `(patch) <https://github.com/django/django/commit/594a28a904>`__
* Django 1.1 `(patch) <https://github.com/django/django/commit/e3e992e18b>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/e3e992e18b>`__
September 8, 2010 - CVE-2010-3082 September 8, 2010 - :cve:`2010-3082`
--------------------------------- ------------------------------------
`CVE-2010-3082 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3082&cid=3>`_: XSS via trusting unsafe cookie value. `Full description <https://www.djangoproject.com/weblog/2010/sep/08/security-release/>`__ XSS via trusting unsafe cookie value. `Full description
<https://www.djangoproject.com/weblog/2010/sep/08/security-release/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
* Django 1.2 `(patch) <https://github.com/django/django/commit/7f84657b6b>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/7f84657b6b>`__
December 22, 2010 - CVE-2010-4534 December 22, 2010 - :cve:`2010-4534`
--------------------------------- ------------------------------------
`CVE-2010-4534 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4534&cid=3>`_: Information leakage in administrative interface. `Full description <https://www.djangoproject.com/weblog/2010/dec/22/security/>`__ Information leakage in administrative interface. `Full description
<https://www.djangoproject.com/weblog/2010/dec/22/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -144,10 +153,11 @@ Versions affected
* Django 1.1 `(patch) <https://github.com/django/django/commit/17084839fd>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/17084839fd>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/85207a245b>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/85207a245b>`__
December 22, 2010 - CVE-2010-4535 December 22, 2010 - :cve:`2010-4535`
--------------------------------- ------------------------------------
`CVE-2010-4535 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4535&cid=2>`_: Denial-of-service in password-reset mechanism. `Full description <https://www.djangoproject.com/weblog/2010/dec/22/security/>`__ Denial-of-service in password-reset mechanism. `Full description
<https://www.djangoproject.com/weblog/2010/dec/22/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -155,10 +165,11 @@ Versions affected
* Django 1.1 `(patch) <https://github.com/django/django/commit/7f8dd9cbac>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/7f8dd9cbac>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/d5d8942a16>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/d5d8942a16>`__
February 8, 2011 - CVE-2011-0696 February 8, 2011 - :cve:`2011-0696`
-------------------------------- -----------------------------------
`CVE-2011-0696 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0696&cid=2>`_: CSRF via forged HTTP headers. `Full description <https://www.djangoproject.com/weblog/2011/feb/08/security/>`__ CSRF via forged HTTP headers. `Full description
<https://www.djangoproject.com/weblog/2011/feb/08/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -166,10 +177,11 @@ Versions affected
* Django 1.1 `(patch) <https://github.com/django/django/commit/408c5c873c>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/408c5c873c>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/818e70344e>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/818e70344e>`__
February 8, 2011 - CVE-2011-0697 February 8, 2011 - :cve:`2011-0697`
-------------------------------- -----------------------------------
`CVE-2011-0697 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0697&cid=2>`_: XSS via unsanitized names of uploaded files. `Full description <https://www.djangoproject.com/weblog/2011/feb/08/security/>`__ XSS via unsanitized names of uploaded files. `Full description
<https://www.djangoproject.com/weblog/2011/feb/08/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -177,10 +189,11 @@ Versions affected
* Django 1.1 `(patch) <https://github.com/django/django/commit/1966786d2d>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/1966786d2d>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/1f814a9547>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/1f814a9547>`__
February 8, 2011 - CVE-2011-0698 February 8, 2011 - :cve:`2011-0698`
-------------------------------- -----------------------------------
`CVE-2011-0698 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0698&cid=2>`_: Directory-traversal on Windows via incorrect path-separator handling. `Full description <https://www.djangoproject.com/weblog/2011/feb/08/security/>`__ Directory-traversal on Windows via incorrect path-separator handling. `Full
description <https://www.djangoproject.com/weblog/2011/feb/08/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -188,10 +201,11 @@ Versions affected
* Django 1.1 `(patch) <https://github.com/django/django/commit/570a32a047>`__ * Django 1.1 `(patch) <https://github.com/django/django/commit/570a32a047>`__
* Django 1.2 `(patch) <https://github.com/django/django/commit/194566480b>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/194566480b>`__
September 9, 2011 - CVE-2011-4136 September 9, 2011 - :cve:`2011-4136`
--------------------------------- ------------------------------------
`CVE-2011-4136 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4136&cid=2>`_: Session manipulation when using memory-cache-backed session. `Full description <https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__ Session manipulation when using memory-cache-backed session. `Full description
<https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -199,10 +213,11 @@ Versions affected
* Django 1.2 `(patch) <https://github.com/django/django/commit/ac7c3a110f>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/ac7c3a110f>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/fbe2eead2f>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/fbe2eead2f>`__
September 9, 2011 - CVE-2011-4137 September 9, 2011 - :cve:`2011-4137`
--------------------------------- ------------------------------------
`CVE-2011-4137 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4137&cid=2>`_: Denial-of-service via ``URLField.verify_exists``. `Full description <https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__ Denial-of-service via ``URLField.verify_exists``. `Full description
<https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -210,10 +225,12 @@ Versions affected
* Django 1.2 `(patch) <https://github.com/django/django/commit/7268f8af86>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/7268f8af86>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__
September 9, 2011 - CVE-2011-4138 September 9, 2011 - :cve:`2011-4138`
--------------------------------- ------------------------------------
`CVE-2011-4138 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4138&cid=2>`_: Information leakage/arbitrary request issuance via ``URLField.verify_exists``. `Full description <https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__ Information leakage/arbitrary request issuance via ``URLField.verify_exists``.
`Full description
<https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -221,10 +238,11 @@ Versions affected
* Django 1.2: `(patch) <https://github.com/django/django/commit/7268f8af86>`__ * Django 1.2: `(patch) <https://github.com/django/django/commit/7268f8af86>`__
* Django 1.3: `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__ * Django 1.3: `(patch) <https://github.com/django/django/commit/1a76dbefdf>`__
September 9, 2011 - CVE-2011-4139 September 9, 2011 - :cve:`2011-4139`
--------------------------------- ------------------------------------
`CVE-2011-4139 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4139&cid=2>`_: ``Host`` header cache poisoning. `Full description <https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__ ``Host`` header cache poisoning. `Full description
<https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -232,10 +250,11 @@ Versions affected
* Django 1.2 `(patch) <https://github.com/django/django/commit/c613af4d64>`__ * Django 1.2 `(patch) <https://github.com/django/django/commit/c613af4d64>`__
* Django 1.3 `(patch) <https://github.com/django/django/commit/2f7fadc38e>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/2f7fadc38e>`__
September 9, 2011 - CVE-2011-4140 September 9, 2011 - :cve:`2011-4140`
--------------------------------- ------------------------------------
`CVE-2011-4140 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4140&cid=2>`_: Potential CSRF via ``Host`` header. `Full description <https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__ Potential CSRF via ``Host`` header. `Full description
<https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -245,10 +264,11 @@ This notification was an advisory only, so no patches were issued.
* Django 1.2 * Django 1.2
* Django 1.3 * Django 1.3
July 30, 2012 - CVE-2012-3442 July 30, 2012 - :cve:`2012-3442`
----------------------------- --------------------------------
`CVE-2012-3442 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3442&cid=2>`_: XSS via failure to validate redirect scheme. `Full description <https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__ XSS via failure to validate redirect scheme. `Full description
<https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -256,10 +276,11 @@ Versions affected
* Django 1.3: `(patch) <https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d>`__ * Django 1.3: `(patch) <https://github.com/django/django/commit/4dea4883e6c50d75f215a6b9bcbd95273f57c72d>`__
* Django 1.4: `(patch) <https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1>`__ * Django 1.4: `(patch) <https://github.com/django/django/commit/e34685034b60be1112160e76091e5aee60149fa1>`__
July 30, 2012 - CVE-2012-3443 July 30, 2012 - :cve:`2012-3443`
----------------------------- --------------------------------
`CVE-2012-3443 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3443&cid=2>`_: Denial-of-service via compressed image files. `Full description <https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__ Denial-of-service via compressed image files. `Full description
<https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -267,10 +288,11 @@ Versions affected
* Django 1.3: `(patch) <https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446>`__ * Django 1.3: `(patch) <https://github.com/django/django/commit/b2eb4787a0fff9c9993b78be5c698e85108f3446>`__
* Django 1.4: `(patch) <https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141>`__ * Django 1.4: `(patch) <https://github.com/django/django/commit/c14f325c4eef628bc7bfd8873c3a72aeb0219141>`__
July 30, 2012 - CVE-2012-3444 July 30, 2012 - :cve:`2012-3444`
----------------------------- --------------------------------
`CVE-2012-3444 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3444&cid=2>`_: Denial-of-service via large image files. `Full description <https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__ Denial-of-service via large image files. `Full description
<https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -278,10 +300,11 @@ Versions affected
* Django 1.3 `(patch) <https://github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/9ca0ff6268eeff92d0d0ac2c315d4b6a8e229155>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/da33d67181b53fe6cc737ac1220153814a1509f6>`__
October 17, 2012 - CVE-2012-4520 October 17, 2012 - :cve:`2012-4520`
-------------------------------- -----------------------------------
`CVE-2012-4520 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4520&cid=2>`_: ``Host`` header poisoning. `Full description <https://www.djangoproject.com/weblog/2012/oct/17/security/>`__ ``Host`` header poisoning. `Full description
<https://www.djangoproject.com/weblog/2012/oct/17/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -292,7 +315,8 @@ Versions affected
December 10, 2012 - No CVE 1 December 10, 2012 - No CVE 1
---------------------------- ----------------------------
Additional hardening of ``Host`` header handling. `Full description <https://www.djangoproject.com/weblog/2012/dec/10/security/>`__ Additional hardening of ``Host`` header handling. `Full description
<https://www.djangoproject.com/weblog/2012/dec/10/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -303,7 +327,8 @@ Versions affected
December 10, 2012 - No CVE 2 December 10, 2012 - No CVE 2
---------------------------- ----------------------------
Additional hardening of redirect validation. `Full description <https://www.djangoproject.com/weblog/2012/dec/10/security/>`__ Additional hardening of redirect validation. `Full description
<https://www.djangoproject.com/weblog/2012/dec/10/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -314,7 +339,8 @@ Versions affected
February 19, 2013 - No CVE February 19, 2013 - No CVE
-------------------------- --------------------------
Additional hardening of ``Host`` header handling. `Full description <https://www.djangoproject.com/weblog/2013/feb/19/security/>`__ Additional hardening of ``Host`` header handling. `Full description
<https://www.djangoproject.com/weblog/2013/feb/19/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -322,10 +348,11 @@ Versions affected
* Django 1.3 `(patch) <https://github.com/django/django/commit/27cd872e6e36a81d0bb6f5b8765a1705fecfc253>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/27cd872e6e36a81d0bb6f5b8765a1705fecfc253>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/9936fdb11d0bbf0bd242f259bfb97bbf849d16f8>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/9936fdb11d0bbf0bd242f259bfb97bbf849d16f8>`__
February 19, 2013 - CVE-2013-1664/1665 February 19, 2013 - :cve:`2013-1664` / :cve:`2013-1665`
-------------------------------------- -------------------------------------------------------
`CVE-2013-1664 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1664&cid=2>`_ and `CVE-2013-1665 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1665&cid=2>`_: Entity-based attacks against Python XML libraries. `Full description <https://www.djangoproject.com/weblog/2013/feb/19/security/>`__ Entity-based attacks against Python XML libraries. `Full description
<https://www.djangoproject.com/weblog/2013/feb/19/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -333,10 +360,11 @@ Versions affected
* Django 1.3 `(patch) <https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/1c60d07ba23e0350351c278ad28d0bd5aa410b40>`__
February 19, 2013 - CVE-2013-0305 February 19, 2013 - :cve:`2013-0305`
--------------------------------- ------------------------------------
`CVE-2013-0305 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0305&cid=2>`_: Information leakage via admin history log. `Full description <https://www.djangoproject.com/weblog/2013/feb/19/security/>`__ Information leakage via admin history log. `Full description
<https://www.djangoproject.com/weblog/2013/feb/19/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -344,10 +372,11 @@ Versions affected
* Django 1.3 `(patch) <https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/0e7861aec73702f7933ce2a93056f7983939f0d6>`__
February 19, 2013 - CVE-2013-0306 February 19, 2013 - :cve:`2013-0306`
--------------------------------- ------------------------------------
`CVE-2013-0306 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0306&cid=2>`_: Denial-of-service via formset ``max_num`` bypass. `Full description <https://www.djangoproject.com/weblog/2013/feb/19/security/>`__ Denial-of-service via formset ``max_num`` bypass. `Full description
<https://www.djangoproject.com/weblog/2013/feb/19/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -355,20 +384,22 @@ Versions affected
* Django 1.3 `(patch) <https://github.com/django/django/commit/d7094bbce8cb838f3b40f504f198c098ff1cf727>`__ * Django 1.3 `(patch) <https://github.com/django/django/commit/d7094bbce8cb838f3b40f504f198c098ff1cf727>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/0cc350a896f70ace18280410eb616a9197d862b0>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/0cc350a896f70ace18280410eb616a9197d862b0>`__
August 13, 2013 - CVE-2013-4249 August 13, 2013 - :cve:`2013-4249`
------------------------------- ----------------------------------
`CVE-2013-4249 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4249&cid=2>`_: XSS via admin trusting ``URLField`` values. `Full description <https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/>`__ XSS via admin trusting ``URLField`` values. `Full description
<https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
* Django 1.5 `(patch) <https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78>`__ * Django 1.5 `(patch) <https://github.com/django/django/commit/90363e388c61874add3f3557ee654a996ec75d78>`__
August 13, 2013 - CVE-2013-6044 August 13, 2013 - :cve:`2013-6044`
------------------------------- ----------------------------------
`CVE-2013-6044 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6044&cid=2>`_: Possible XSS via unvalidated URL redirect schemes. `Full description <https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/>`__ Possible XSS via unvalidated URL redirect schemes. `Full description
<https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -376,10 +407,11 @@ Versions affected
* Django 1.4 `(patch) <https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/ec67af0bd609c412b76eaa4cc89968a2a8e5ad6a>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f>`__ * Django 1.5 `(patch) <https://github.com/django/django/commit/1a274ccd6bc1afbdac80344c9b6e5810c1162b5f>`__
September 10, 2013 - CVE-2013-4315 September 10, 2013 - :cve:`2013-4315`
---------------------------------- -------------------------------------
`CVE-2013-4315 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4315&cid=2>`_ Directory-traversal via ``ssi`` template tag. `Full description <https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/>`__ Directory-traversal via ``ssi`` template tag. `Full description
<https://www.djangoproject.com/weblog/2013/sep/10/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -387,10 +419,11 @@ Versions affected
* Django 1.4 `(patch) <https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/87d2750b39f6f2d54b7047225521a44dcd37e896>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca>`__ * Django 1.5 `(patch) <https://github.com/django/django/commit/988b61c550d798f9a66d17ee0511fb7a9a7f33ca>`__
September 14, 2013 - CVE-2013-1443 September 14, 2013 - :cve:`2013-1443`
---------------------------------- -------------------------------------
CVE-2013-1443: Denial-of-service via large passwords. `Full description <https://www.djangoproject.com/weblog/2013/sep/15/security/>`__ Denial-of-service via large passwords. `Full description
<https://www.djangoproject.com/weblog/2013/sep/15/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -398,10 +431,11 @@ Versions affected
* Django 1.4 `(patch <https://github.com/django/django/commit/3f3d887a6844ec2db743fee64c9e53e04d39a368>`__ and `Python compatibility fix) <https://github.com/django/django/commit/6903d1690a92aa040adfb0c8eb37cf62e4206714>`__ * Django 1.4 `(patch <https://github.com/django/django/commit/3f3d887a6844ec2db743fee64c9e53e04d39a368>`__ and `Python compatibility fix) <https://github.com/django/django/commit/6903d1690a92aa040adfb0c8eb37cf62e4206714>`__
* Django 1.5 `(patch) <https://github.com/django/django/commit/22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>`__ * Django 1.5 `(patch) <https://github.com/django/django/commit/22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc>`__
April 21, 2014 - CVE-2014-0472 April 21, 2014 - :cve:`2014-0472`
------------------------------ ---------------------------------
`CVE-2014-0472 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0472&cid=2>`_: Unexpected code execution using ``reverse()``. `Full description <https://www.djangoproject.com/weblog/2014/apr/21/security/>`__ Unexpected code execution using ``reverse()``. `Full description
<https://www.djangoproject.com/weblog/2014/apr/21/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -411,10 +445,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/4352a50871e239ebcdf64eee6f0b88e714015c1b>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/4352a50871e239ebcdf64eee6f0b88e714015c1b>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/546740544d7f69254a67b06a3fc7fa0c43512958>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/546740544d7f69254a67b06a3fc7fa0c43512958>`__
April 21, 2014 - CVE-2014-0473 April 21, 2014 - :cve:`2014-0473`
------------------------------ ---------------------------------
`CVE-2014-0473 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0473&cid=2>`_: Caching of anonymous pages could reveal CSRF token. `Full description <https://www.djangoproject.com/weblog/2014/apr/21/security/>`__ Caching of anonymous pages could reveal CSRF token. `Full description
<https://www.djangoproject.com/weblog/2014/apr/21/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -424,10 +459,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/d63e20942f3024f24cb8cd85a49461ba8a9b6736>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/d63e20942f3024f24cb8cd85a49461ba8a9b6736>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/380545bf85cbf17fc698d136815b7691f8d023ca>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/380545bf85cbf17fc698d136815b7691f8d023ca>`__
April 21, 2014 - CVE-2014-0474 April 21, 2014 - :cve:`2014-0474`
------------------------------ ---------------------------------
`CVE-2014-0474 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0474&cid=2>`_: MySQL typecasting causes unexpected query results. `Full description <https://www.djangoproject.com/weblog/2014/apr/21/security/>`__ MySQL typecasting causes unexpected query results. `Full description
<https://www.djangoproject.com/weblog/2014/apr/21/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -437,10 +473,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/5f0829a27e85d89ad8c433f5c6a7a7d17c9e9292>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/34526c2f56b863c2103655a0893ac801667e86ea>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/34526c2f56b863c2103655a0893ac801667e86ea>`__
May 18, 2014 - CVE-2014-1418 May 18, 2014 - :cve:`2014-1418`
---------------------------- -------------------------------
`CVE-2014-1418 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1418&cid=2>`_: Caches may be allowed to store and serve private data. `Full description <https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/>`__ Caches may be allowed to store and serve private data. `Full description
<https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -450,10 +487,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/7fef18ba9e5a8b47bc24b5bb259c8bf3d3879f2a>`__
May 18, 2014 - CVE-2014-3730 May 18, 2014 - :cve:`2014-3730`
---------------------------- -------------------------------
`CVE-2014-3730 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3730&cid=2>`_: Malformed URLs from user input incorrectly validated. `Full description <https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/>`__ Malformed URLs from user input incorrectly validated. `Full description
<https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -463,10 +501,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/e7b0cace455c2da24492660636bfd48c45a19cdf>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/e7b0cace455c2da24492660636bfd48c45a19cdf>`__
August 20, 2014 - CVE-2014-0480 August 20, 2014 - :cve:`2014-0480`
------------------------------- ----------------------------------
`CVE-2014-0480 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0480&cid=2>`_: reverse() can generate URLs pointing to other hosts. `Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ ``reverse()`` can generate URLs pointing to other hosts. `Full description
<https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -476,10 +515,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d5>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/da051da8df5e69944745072611351d4cfc6435d5>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/bf650a2ee78c6d1f4544a875dcc777cf27fe93e9>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/bf650a2ee78c6d1f4544a875dcc777cf27fe93e9>`__
August 20, 2014 - CVE-2014-0481 August 20, 2014 - :cve:`2014-0481`
------------------------------- ----------------------------------
`CVE-2014-0481 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0481&cid=2>`_: File upload denial of service. `Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ File upload denial of service. `Full description
<https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -489,10 +529,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/dd0c3f4ee1a30c1a1e6055061c6ba6e58c6b54d1>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/3123f8452cf49071be9110e277eea60ba0032216>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/3123f8452cf49071be9110e277eea60ba0032216>`__
August 20, 2014 - CVE-2014-0482 August 20, 2014 - :cve:`2014-0482`
------------------------------- ----------------------------------
`CVE-2014-0482 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0482&cid=2>`_: RemoteUserMiddleware session hijacking. `Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ ``RemoteUserMiddleware`` session hijacking. `Full description
<https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -502,10 +543,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/1a45d059c70385fcd6f4a3955f3b4e4cc96d0150>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/1a45d059c70385fcd6f4a3955f3b4e4cc96d0150>`__
August 20, 2014 - CVE-2014-0483 August 20, 2014 - :cve:`2014-0483`
------------------------------- ----------------------------------
`CVE-2014-0483 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0483&cid=2>`_: Data leakage via querystring manipulation in admin. `Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__ Data leakage via querystring manipulation in admin.
`Full description <https://www.djangoproject.com/weblog/2014/aug/20/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -515,12 +557,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/f7c494f2506250b8cb5923714360a3642ed63e0f>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/2b31342cdf14fc20e07c43d258f1e7334ad664a6>`__
January 13, 2015 - CVE-2015-0219 January 13, 2015 - :cve:`2015-0219`
-------------------------------- -----------------------------------
`CVE-2015-0219 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0219&cid=2>`_: WSGI header spoofing via underscore/dash conflation. `Full description
WSGI header spoofing via underscore/dash conflation. <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -529,10 +570,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/d7597b31d5c03106eeba4be14a33b32a5e25f4ee>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/d7597b31d5c03106eeba4be14a33b32a5e25f4ee>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/41b4bc73ee0da7b2e09f4af47fc1fd21144c710f>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/41b4bc73ee0da7b2e09f4af47fc1fd21144c710f>`__
January 13, 2015 - CVE-2015-0220 January 13, 2015 - :cve:`2015-0220`
-------------------------------- -----------------------------------
`CVE-2015-0220 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0220&cid=2>`_: Mitigated possible XSS attack via user-supplied redirect URLs. `Full description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__ Mitigated possible XSS attack via user-supplied redirect URLs. `Full
description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -541,12 +583,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/72e0b033662faa11bb7f516f18a132728aa0ae28>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/de67dedc771ad2edec15c1d00c083a1a084e1e89>`__
January 13, 2015 - CVE-2015-0221 January 13, 2015 - :cve:`2015-0221`
-------------------------------- -----------------------------------
`CVE-2015-0221 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0221&cid=2>`_: Denial-of-service attack against ``django.views.static.serve()``. `Full
Denial-of-service attack against ``django.views.static.serve()``. description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -555,12 +596,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/553779c4055e8742cc832ed525b9ee34b174934f>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/553779c4055e8742cc832ed525b9ee34b174934f>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/818e59a3f0fbadf6c447754d202d88df025f8f2a>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/818e59a3f0fbadf6c447754d202d88df025f8f2a>`__
January 13, 2015 - CVE-2015-0222 January 13, 2015 - :cve:`2015-0222`
-------------------------------- -----------------------------------
`CVE-2015-0222 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0222&cid=2>`_: Database denial-of-service with ``ModelMultipleChoiceField``. `Full description
Database denial-of-service with ``ModelMultipleChoiceField``. <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jan/13/security/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -568,12 +608,11 @@ Versions affected
* Django 1.6 `(patch) <https://github.com/django/django/commit/d7a06ee7e571b6dad07c0f5b519b1db02e2a476c>`__ * Django 1.6 `(patch) <https://github.com/django/django/commit/d7a06ee7e571b6dad07c0f5b519b1db02e2a476c>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/bcfb47780ce7caecb409a9e9c1c314266e41d392>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/bcfb47780ce7caecb409a9e9c1c314266e41d392>`__
March 9, 2015 - CVE-2015-2241 March 9, 2015 - :cve:`2015-2241`
----------------------------- --------------------------------
`CVE-2015-2241 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2241&cid=2>`_: XSS attack via properties in ``ModelAdmin.readonly_fields``. `Full description
XSS attack via properties in ``ModelAdmin.readonly_fields``. <https://www.djangoproject.com/weblog/2015/mar/09/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/mar/09/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -581,12 +620,11 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/d16e4e1d6f95e6f46bff53cc4fd0ab398b8e5059>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5>`_ * Django 1.8 `(patch) <https://github.com/django/django/commit/2654e1b93923bac55f12b4e66c5e39b16695ace5>`_
March 18, 2015 - CVE-2015-2316 March 18, 2015 - :cve:`2015-2316`
------------------------------ ---------------------------------
`CVE-2015-2316 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2316&cid=2>`_: Denial-of-service possibility with ``strip_tags()``. `Full description
Denial-of-service possibility with ``strip_tags()``. <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -595,12 +633,11 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd>`__
March 18, 2015 - CVE-2015-2317 March 18, 2015 - :cve:`2015-2317`
------------------------------ ---------------------------------
`CVE-2015-2317 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2317&cid=2>`_: Mitigated possible XSS attack via user-supplied redirect URLs. `Full
Mitigated possible XSS attack via user-supplied redirect URLs. description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/mar/18/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -610,24 +647,22 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/2a4113dbd532ce952308992633d802dc169a75f1>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/770427c2896a078925abfca2317486b284d22f04>`__
May 20, 2015 - CVE-2015-3982 May 20, 2015 - :cve:`2015-3982`
---------------------------- -------------------------------
`CVE-2015-3982 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3982&cid=2>`_: Fixed session flushing in the cached_db backend. `Full description
Fixed session flushing in the cached_db backend. <https://www.djangoproject.com/weblog/2015/may/20/security-release/>`__
`Full description <https://www.djangoproject.com/weblog/2015/may/20/security-release/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/31cb25adecba930bdeee4556709f5a1c42d88fd6>`__
July 8, 2015 - CVE-2015-5143 July 8, 2015 - :cve:`2015-5143`
---------------------------- -------------------------------
`CVE-2015-5143 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5143&cid=2>`_: Denial-of-service possibility by filling session store. `Full
Denial-of-service possibility by filling session store. description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -636,12 +671,11 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/1828f4341ec53a8684112d24031b767eba557663>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/2e47f3e401c29bc2ba5ab794d483cb0820855fb9>`__
July 8, 2015 - CVE-2015-5144 July 8, 2015 - :cve:`2015-5144`
---------------------------- -------------------------------
`CVE-2015-5144 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5144&cid=2>`_: Header injection possibility since validators accept newlines in input. `Full
Header injection possibility since validators accept newlines in input. description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -650,24 +684,20 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a>`__
July 8, 2015 - CVE-2015-5145 July 8, 2015 - :cve:`2015-5145`
---------------------------- -------------------------------
`CVE-2015-5145 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5145&cid=2>`_: Denial-of-service possibility in URL validation. `Full description
Denial-of-service possibility in URL validation. <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2015/jul/08/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
* Django 1.8 `(patch) <https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c>`__
August 18, 2015 - CVE-2015-5963/CVE-2015-5964 August 18, 2015 - :cve:`2015-5963` / :cve:`2015-5964`
--------------------------------------------- -----------------------------------------------------
`CVE-2015-5963 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5963&cid=2>`_
and
`CVE-2015-5964 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5964&cid=2>`_:
Denial-of-service possibility in ``logout()`` view by filling session store. Denial-of-service possibility in ``logout()`` view by filling session store.
`Full description <https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__ `Full description <https://www.djangoproject.com/weblog/2015/aug/18/security-releases/>`__
@ -678,12 +708,11 @@ Versions affected
* Django 1.7 `(patch) <https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/2f5485346ee6f84b4e52068c04e043092daf55f7>`__
* Django 1.4 `(patch) <https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012>`__ * Django 1.4 `(patch) <https://github.com/django/django/commit/575f59f9bc7c59a5e41a081d1f5f55fc859c5012>`__
November 24, 2015 - CVE-2015-8213 November 24, 2015 - :cve:`2015-8213`
--------------------------------- ------------------------------------
`CVE-2015-8213 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8213&cid=2>`_: Settings leak possibility in ``date`` template filter. `Full description
Settings leak possibility in ``date`` template filter. <https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/>`__
`Full description <https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -691,24 +720,24 @@ Versions affected
* Django 1.8 `(patch) <https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991>`__
* Django 1.7 `(patch) <https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172>`__ * Django 1.7 `(patch) <https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172>`__
February 1, 2016 - CVE-2016-2048 February 1, 2016 - :cve:`2016-2048`
-------------------------------- -----------------------------------
`CVE-2016-2048 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2048&cid=2>`_: User with "change" but not "add" permission can create objects for
User with "change" but not "add" permission can create objects for ``ModelAdmin``’s with ``save_as=True``. ``ModelAdmin``’s with ``save_as=True``. `Full description
`Full description <https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/>`__ <https://www.djangoproject.com/weblog/2016/feb/01/releases-192-and-189/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
* Django 1.9 `(patch) <https://github.com/django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265>`__ * Django 1.9 `(patch) <https://github.com/django/django/commit/adbca5e4db42542575734b8e5d26961c8ada7265>`__
March 1, 2016 - CVE-2016-2512 March 1, 2016 - :cve:`2016-2512`
----------------------------- --------------------------------
`CVE-2016-2512 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2512&cid=2>`_: Malicious redirect and possible XSS attack via user-supplied redirect URLs
Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth. containing basic auth. `Full description
`Full description <https://www.djangoproject.com/weblog/2016/mar/01/security-releases/>`__ <https://www.djangoproject.com/weblog/2016/mar/01/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -716,12 +745,12 @@ Versions affected
* Django 1.9 `(patch) <https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380>`__ * Django 1.9 `(patch) <https://github.com/django/django/commit/fc6d147a63f89795dbcdecb0559256470fff4380>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/382ab137312961ad62feb8109d70a5a581fe8350>`__
March 1, 2016 - CVE-2016-2513 March 1, 2016 - :cve:`2016-2513`
----------------------------- --------------------------------
`CVE-2016-2513 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2513&cid=2>`_: User enumeration through timing difference on password hasher work factor
User enumeration through timing difference on password hasher work factor upgrade. upgrade. `Full description
`Full description <https://www.djangoproject.com/weblog/2016/mar/01/security-releases/>`__ <https://www.djangoproject.com/weblog/2016/mar/01/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
@ -729,12 +758,11 @@ Versions affected
* Django 1.9 `(patch) <https://github.com/django/django/commit/af7d09b0c5c6ab68e629fd9baf736f9dd203b18e>`__ * Django 1.9 `(patch) <https://github.com/django/django/commit/af7d09b0c5c6ab68e629fd9baf736f9dd203b18e>`__
* Django 1.8 `(patch) <https://github.com/django/django/commit/f4e6e02f7713a6924d16540be279909ff4091eb6>`__ * Django 1.8 `(patch) <https://github.com/django/django/commit/f4e6e02f7713a6924d16540be279909ff4091eb6>`__
July 18, 2016 - CVE-2016-6186 July 18, 2016 - :cve:`2016-6186`
----------------------------- --------------------------------
`CVE-2016-6186 <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6186&cid=2>`_: XSS in admin's add/change related popup. `Full description
XSS in admin's add/change related popup. <https://www.djangoproject.com/weblog/2016/jul/18/security-releases/>`__
`Full description <https://www.djangoproject.com/weblog/2016/jul/18/security-releases/>`__
Versions affected Versions affected
~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~