validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service
    (CPU consumption) via unspecified vectors. (CVE-2015-5145)

The remote host is affected by the vulnerability described in GLSA-201510-06 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Django:
      Session backends create a new record anytime request.session was         accessed (CVE-2015-5143)       Built-in validators in Django do not properly sanitize input         (CVE-2015-5144)       URL validation included a regular expression that was extremely slow         (CVE-2015-5145)   Impact :

    A remote attacker may be able cause a Denial of Service condition,       inject arbitrary headers, and conduct HTTP response splitting attacks.
  Workaround :

    There is no known workaround at this time.

update to 1.8.3 fixing 3 CVE

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tim Graham reports :

In accordance with our security release policy, the Django team is issuing multiple releases -- Django 1.4.21, 1.7.9, and 1.8.3. These releases are now available on PyPI and our download page. These releases address several security issues detailed below. We encourage all users of Django to upgrade as soon as possible. The Django master branch has also been updated.

ID	Name	Product	Family	Severity
434729	SCA: security update for Django (GHSA-cqf7-ff9h-7967)	Tenable Cloud Security	SCA Checks	high
434729	SCA: security update for Django (GHSA-cqf7-ff9h-7967)	Tenable Self-Hosted Container Security	SCA Checks	high
86691	GLSA-201510-06 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
84968	Fedora 22 : python-django-1.8.3-1.fc22 (2015-11403)	Nessus	Fedora Local Security Checks	high
84652	FreeBSD : django -- multiple vulnerabilities (37ed8e9c-2651-11e5-86ff-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-5145

high

Tenable Plugins

high

high

high

high

high