The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.

This update fixes CVE-2015-8213: Fixed settings leak possibility in date template filter, more info can be found https://www.djangoproject.com/weblog/2015/nov/24/security-releases-iss ued/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.8.7 , fixing CVE-2015-8213 (rhbz#1285278) ---- python- django-1.8.4-1.fc22 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of-service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial- of-service possibility in logout() view by filling session store (rhbz#1252891) python-django-1.8.4-1.fc23 - Do not install bash completion for python executables (Ville Skytta, rhbz#1253076) - CVE-2015-5963 Denial-of- service possibility in logout() view by filling session store (rhbz#1254911) - CVE-2015-5964 Denial-of-service possibility in logout() view by filling session store (rhbz#1252891)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The python-Django package was updated to fix the following security issue :

  - CVE-2015-8213: Fixed a problem to prevent settings leak     in date template filter (bnc#955412).

The python-django package was updated to fix the following security issue :

  - CVE-2015-8213: Fixed a problem to prevent settings leak     in date template filter (bnc#955412)

Tim Graham reports :

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. 'SECRET_KEY' instead of 'j/m/Y'.

Ryan Butterfield discovered a vulnerability in the date template filter in python-django, a high-level Python web development framework. A remote attacker can take advantage of this flaw to obtain any secret in the application's settings.

It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework.

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. 'SECRET_KEY' instead of 'j/m/Y'.

To remedy this, the underlying function used by the date template filter, django.utils.formats.get_format(), now only allows accessing the date/time formatting settings.

For Debian 6 Squeeze, this issue has been fixed in python-django version 1.2.3-3+squeeze15.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89358	Fedora 23 : python-django-1.8.7-1.fc23 (2015-a8c8f60fbd)	Nessus	Fedora Local Security Checks	medium
89201	Fedora 22 : python-django-1.8.7-1.fc22 (2015-323274d412)	Nessus	Fedora Local Security Checks	medium
87439	openSUSE Security Update : python-Django (openSUSE-2015-862)	Nessus	SuSE Local Security Checks	medium
87438	openSUSE Security Update : python-django (openSUSE-2015-860)	Nessus	SuSE Local Security Checks	medium
87114	FreeBSD : django -- information leak vulnerability (11c52bc6-97aa-11e5-b8df-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
87077	Debian DSA-3404-1 : python-django - security update	Nessus	Debian Local Security Checks	medium
87070	Debian DLA-349-1 : python-django security update	Nessus	Debian Local Security Checks	medium
87065	Ubuntu 14.04 LTS : Django vulnerability (USN-2816-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-8213

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium