Skip to content
OpenAdvisories
High USN-2539-1 2 CVEs

python-django vulnerabilities

Published Mar 23, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Andrey Babak discovered that Django incorrectly handled strip_tags. A
remote attacker could possibly use this issue to cause Django to enter an
infinite loop, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2316)

Daniel Chatfield discovered that Django incorrectly handled user-supplied
redirect URLs. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2015-2317)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS python-django 1.6.1-2ubuntu0.8

Vulnerabilities 2

  • High 7.5
    CVE-2015-2316

    Django Denial-of-service possibility with strip_tags

    The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input str…

    python-django django python-django Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2015-2317

    Django cross-site scripting (XSS) attack via user-supplied redirect URLs

    The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control char…

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2015-2316
  • report
    https://ubuntu.com/security/CVE-2015-2317