Skip to content
OpenAdvisories
High DLA-272-1 3 CVEs

python-django - security update

Published Jul 16, 2015 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 python-django 1.2.3-3+squeeze13

Vulnerabilities 3

  • High 7.5
    CVE-2015-5143

    Django Denial-of-service by filling session store

    The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2015-5144

    Django Vulnerable to HTTP Response Splitting Attack

    Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1)…

    python-django django python-django Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2015-2317

    Django cross-site scripting (XSS) attack via user-supplied redirect URLs

    The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control char…

    python-django django python-django Debian Ubuntu PyPI