Skip to content
OpenAdvisories
High · 7.5 CVE-2015-2316 EUVD-2015-0007GHSA-j3j3-jrfh-cm2wPYSEC-2015-18

Django Denial-of-service possibility with strip_tags

Published Mar 25, 2015 · Updated Aug 6, 2024 · Assigned by mitre

Package: django Package: python-django Package: python-django Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-django 1.7.7-1 —
Debian 13 python-django 1.7.7-1 —
Debian 12 python-django 1.7.7-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS python-django 1.6.1-2ubuntu0.8 USN-2539-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Enterprise Storage 1.0 python-Django 1.6.11-4.1 SUSE-SU-2015:1112-1, SUSE-SU-2015:1109-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI django >= 1.6, < 1.6.11 1.6.11 GHSA-j3j3-jrfh-cm2w
PyPI django >= 1.7, < 1.7.7 1.7.7 GHSA-j3j3-jrfh-cm2w
PyPI django >= 1.8a1, < 1.8c1 1.8c1 GHSA-j3j3-jrfh-cm2w
PyPI django >= 1.6, < 1.6.11 · >= 1.7, < 1.7.7 · >= 1.8a0, < 1.8c1 1.6.11, 1.7.7, 1.8c1 PYSEC-2015-18

Advisories 3

References