Security update for python-django SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2015:1802-1 Final 1 1 2015-10-14T10:49:00Z current 2015-10-14T10:49:00Z 2015-10-14T10:49:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-django python-django was updated to fix two security issues. These security issues were fixed: - CVE-2015-5144: Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 used an incorrect regular expression, which allowed remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator (bsc#937523). - CVE-2015-5143: The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allowed remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys (bsc#937522). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html E-Mail link for openSUSE-SU-2015:1802-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings python-django-1.5.12-0.2.14.1 The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. CVE-2015-5143 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html https://www.suse.com/security/cve/CVE-2015-5143.html CVE-2015-5143 https://bugzilla.suse.com/937522 SUSE Bug 937522 Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. CVE-2015-5144 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html https://www.suse.com/security/cve/CVE-2015-5144.html CVE-2015-5144 https://bugzilla.suse.com/937523 SUSE Bug 937523