CVE-2015-2317
Fixed in a distro release EPSS 5%
The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.
Products: debian_linux, fedoraproject fedora, opensuse, djangoproject django, oracle solaris, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 1.4.20 |
| PyPI | django | 1.6.11 |
| PyPI | django | 1.7.7 |
| PyPI | django | 1.8c1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-django | 1.7.7-1 |
| Debian 13 | python-django | 1.7.7-1 |
| Debian 14 | python-django | 1.7.7-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze13 |
| Debian 7 | python-django | 1.4.5-1+deb7u11 |
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-4.1 |
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.8 |