Skip to content
OpenAdvisories
High USN-2915-1 2 CVEs

python-django vulnerabilities

Published Mar 1, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Mark Striemer discovered that Django incorrectly handled user-supplied
redirect URLs containing basic authentication credentials. A remote
attacker could possibly use this issue to perform a cross-site scripting
attack or a malicious redirect. (CVE-2016-2512)

Sjoerd Job Postmus discovered that Django incorrectly handled timing when
doing password hashing operations. A remote attacker could possibly use
this issue to perform user enumeration. (CVE-2016-2513)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS python-django 1.6.1-2ubuntu0.12

Vulnerabilities 2

  • High 7.4
    CVE-2016-2512

    Django XSS Vulnerability

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic …

    python-django django python-django Debian Ubuntu PyPI
  • Low 3.1
    CVE-2016-2513

    Django User Enumeration Vulnerability

    The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2016-2512
  • report
    https://ubuntu.com/security/CVE-2016-2513