Skip to content
OpenAdvisories
High DSA-3544-1 2 CVEs

python-django - security update

Published Apr 7, 2016 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 7 python-django 1.4.5-1+deb7u16
Debian · 8 python-django 1.7.7-1+deb8u4

Vulnerabilities 2

  • High 7.4
    CVE-2016-2512

    Django XSS Vulnerability

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic …

    python-django django python-django Debian Ubuntu PyPI
  • Low 3.1
    CVE-2016-2513

    Django User Enumeration Vulnerability

    The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

    python-django django python-django Debian Ubuntu PyPI