7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.135 Low
EPSS
Percentile
95.6%
Several vulnerabilities were discovered in Django, a high-level Python web development framework :
CVE-2015-5143 Eric Peterson and Lin Hua Cheng discovered that a new empty record used to be created in the session storage every time a session was accessed and an unknown session key was provided in the request cookie. This could allow remote attackers to saturate the session store or cause other users’ session records to be evicted.
CVE-2015-5144 Sjoerd Job Postmus discovered that some built-in validators did not properly reject newlines in input values. This could allow remote attackers to inject headers in emails and HTTP responses.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DSA-3305. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(84626);
script_version("2.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/11");
script_cve_id("CVE-2015-5143", "CVE-2015-5144");
script_xref(name:"DSA", value:"3305");
script_name(english:"Debian DSA-3305-1 : python-django - security update");
script_summary(english:"Checks dpkg output for the updated package");
script_set_attribute(
attribute:"synopsis",
value:"The remote Debian host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"Several vulnerabilities were discovered in Django, a high-level Python
web development framework :
- CVE-2015-5143
Eric Peterson and Lin Hua Cheng discovered that a new
empty record used to be created in the session storage
every time a session was accessed and an unknown session
key was provided in the request cookie. This could allow
remote attackers to saturate the session store or cause
other users' session records to be evicted.
- CVE-2015-5144
Sjoerd Job Postmus discovered that some built-in
validators did not properly reject newlines in input
values. This could allow remote attackers to inject
headers in emails and HTTP responses."
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2015-5143"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2015-5144"
);
script_set_attribute(
attribute:"see_also",
value:"https://packages.debian.org/source/wheezy/python-django"
);
script_set_attribute(
attribute:"see_also",
value:"https://packages.debian.org/source/jessie/python-django"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.debian.org/security/2015/dsa-3305"
);
script_set_attribute(
attribute:"solution",
value:
"Upgrade the python-django packages.
For the oldstable distribution (wheezy), these problems have been
fixed in version 1.4.5-1+deb7u12.
For the stable distribution (jessie), these problems have been fixed
in version 1.7.7-1+deb8u1."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-django");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
script_set_attribute(attribute:"patch_publication_date", value:"2015/07/08");
script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/09");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Debian Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("debian_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (deb_check(release:"7.0", prefix:"python-django", reference:"1.4.5-1+deb7u12")) flag++;
if (deb_check(release:"7.0", prefix:"python-django-doc", reference:"1.4.5-1+deb7u12")) flag++;
if (deb_check(release:"8.0", prefix:"python-django", reference:"1.7.7-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"python-django-common", reference:"1.7.7-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"python-django-doc", reference:"1.7.7-1+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"python3-django", reference:"1.7.7-1+deb8u1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
else security_hole(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
Vendor | Product | Version | CPE |
---|---|---|---|
debian | debian_linux | python-django | p-cpe:/a:debian:debian_linux:python-django |
debian | debian_linux | 7.0 | cpe:/o:debian:debian_linux:7.0 |
debian | debian_linux | 8.0 | cpe:/o:debian:debian_linux:8.0 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5143
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5144
packages.debian.org/source/jessie/python-django
packages.debian.org/source/wheezy/python-django
security-tracker.debian.org/tracker/CVE-2015-5143
security-tracker.debian.org/tracker/CVE-2015-5144
www.debian.org/security/2015/dsa-3305