Django vulnerabilities

2011-01-0700:00:00

ubuntu.com

6.3 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.132 Low

EPSS

Percentile

95.5%

JSON

Releases

Ubuntu 10.10
Ubuntu 10.04
Ubuntu 9.10

Packages

python-django - High-level Python web development framework

Details

Adam Baldwin discovered that Django did not properly validate query string
lookups. This could be exploited to provide an information leak to an
attacker with admin privilieges. (CVE-2010-4534)

Paul McMillan discovered that Django did not validate the length of the
token used when generating a password reset. An attacker could exploit
this to cause a denial of service via resource exhaustion. (CVE-2010-4535)

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchpython-django< 1.1.1-1ubuntu1.1UNKNOWN
Ubuntu9.10noarchpython-django-doc< 1.1.1-1ubuntu1.1UNKNOWN
Ubuntu10.10noarchpython-django< 1.2.3-1ubuntu0.2.10.10.1UNKNOWN
Ubuntu10.10noarchpython-django-doc< 1.2.3-1ubuntu0.2.10.10.1UNKNOWN
Ubuntu10.04noarchpython-django< 1.1.1-2ubuntu1.2UNKNOWN
Ubuntu10.04noarchpython-django-doc< 1.1.1-2ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	python-django	< 1.1.1-1ubuntu1.1	UNKNOWN
Ubuntu	9.10	noarch	python-django-doc	< 1.1.1-1ubuntu1.1	UNKNOWN
Ubuntu	10.10	noarch	python-django	< 1.2.3-1ubuntu0.2.10.10.1	UNKNOWN
Ubuntu	10.10	noarch	python-django-doc	< 1.2.3-1ubuntu0.2.10.10.1	UNKNOWN
Ubuntu	10.04	noarch	python-django	< 1.1.1-2ubuntu1.2	UNKNOWN
Ubuntu	10.04	noarch	python-django-doc	< 1.1.1-2ubuntu1.2	UNKNOWN