openSUSE Security Update : python-django (openSUSE-2015-674)

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

python-django was updated to fix two security issues.

These security issues were fixed :

- CVE-2015-5144: Django before 1.4.21, 1.5.x through
1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used
an incorrect regular expression, which allowed remote
attackers to inject arbitrary headers and conduct HTTP
response splitting attacks via a newline character in an
(1) email message to the EmailValidator, a (2) URL to
the URLValidator, or unspecified vectors to the (3)
validate_ipv4_address or (4) validate_slug validator
(bsc#937523).

- CVE-2015-5143: The session backends in Django before
1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and
1.8.x before 1.8.3 allowed remote attackers to cause a
denial of service (session store consumption) via
multiple requests with unique session keys (bsc#937522).

See also :

https://bugzilla.opensuse.org/show_bug.cgi?id=937522
https://bugzilla.opensuse.org/show_bug.cgi?id=937523

Solution :

Update the affected python-django package.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 86555 ()

Bugtraq ID:

CVE ID: CVE-2015-5143
CVE-2015-5144

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now