MGASA-2015-0463 Updated python-django packages fix security vulnerability

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format CVE-2015-8213...

Updated python-django packages fix security vulnerability

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format CVE-2015-8213...

FreeBSD : django -- information leak vulnerability (11c52bc6-97aa-11e5-b8df-14dae9d210b8)

Tim Graham reports : If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. lastupdated|date:userdateformat , then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a da...

Debian DSA-3404-1 : python-django - security update

Ryan Butterfield discovered a vulnerability in the date template filter in python-django, a high-level Python web development framework. A remote attacker can take advantage of this flaw to obtain any secret in the application's settings. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DLA-349-1 : python-django security update

It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework. If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. lastupdated|date:userdateformat , then a malicious...

python-django date template filter information disclosure vulnerability

Django is the open source Python Web application development framework. A security vulnerability exists in the date template filter of python-django. A remote attacker can exploit this vulnerability to obtain sensitive information within the application settings...

Security fix for the ALT Linux 9 package python3-module-django version 1.8.7-alt1

Nov. 27, 2015 Alexey Shabalin 1.8.7-alt1 - 1.8.7 - fixed CVE-2015-8213...

Security fix for the ALT Linux 10 package python3-module-django version 1.8.7-alt1

Nov. 27, 2015 Alexey Shabalin 1.8.7-alt1 - 1.8.7 - fixed CVE-2015-8213...

[SECURITY] [DLA 349-1] python-django security update

Package : python-django Version : 1.2.3-3+squeeze15 CVE ID : CVE-2015-8213 It was discovered that there was a potential settings leak in date template filter of Django, a web-development framework. If an application allows users to specify an unvalidated format for dates and passes this format to...

[SECURITY] [DSA 3404-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3404-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 25, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3404-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3404-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 25, 2015 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3404-1 (python-django - security update)

Ryan Butterfield discovered a vulnerability in the date template filter in python-django, a high-level Python web development framework. A remote attacker can take advantage of this flaw to obtain any secret in the application OpenVAS Vulnerability Test $Id: deb3404.nasl 6609 2017-07-07 12:05:59Z...

DSA-3404-1 python-django - security update

Bulletin has no description...

DLA-349-1 python-django - security update

Bulletin has no description...

Ubuntu 14.04 LTS : Django vulnerability (USN-2816-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2816-1 advisory. Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from...

Ubuntu: Security Advisory (USN-2816-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubiquiti Inc.: account.ubnt.com CSRF

Good Evening Sir, I want to inform you that i have successfully discovered a problem on the API django Restfull API you used to manage the security of https://account.ubnt.com The vulnerability type : CSRF Vulnerability description : An attacker create a web page with the code attached to this...

USN-2816-1: Django vulnerability

Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings...

USN-2816-1 python-django vulnerability

Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings...

CVE-2015-8213

The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...