Skip to content
OpenAdvisories
High RHSA-2016:0502 2 CVEs

Red Hat Security Advisory: python-django security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 5 openstack:5::el6 python-django 0:1.6.11-5.el6ost
Red Hat · OpenStack 5 openstack:5::el6 python-django-bash-completion 0:1.6.11-5.el6ost
Red Hat · OpenStack 5 openstack:5::el6 python-django-doc 0:1.6.11-5.el6ost

Vulnerabilities 2

  • High 7.4
    CVE-2016-2512

    Django XSS Vulnerability

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic …

    python-django django python-django Debian Ubuntu PyPI
  • Low 3.1
    CVE-2016-2513

    Django User Enumeration Vulnerability

    The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

    python-django django python-django Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1311438
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0502.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-2512
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-2512
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-2512
  • article
    https://www.djangoproject.com/weblog/2016/mar/01/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2016-2513
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-2513
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-2513