CVE-2015-8213

Description

The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.

How to fix CVE-2015-8213

To remediate CVE-2015-8213, upgrade the affected package to a fixed version below.

• —upgrade to 1.8.7-1 or later
• —upgrade to 1.2.3-3+squeeze15 or later
• —upgrade to 1.4.5-1+deb7u14 or later
• —upgrade to 1.7.11 or later
• —upgrade to 316bc3fc9437c5960c24baceb93c73f1939711e4 or later

Is CVE-2015-8213 being exploited?

Low — EPSS is 3.0%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.8.7-1
• from 0, < 1.2.3-3+squeeze15
• from 0, < 1.4.5-1+deb7u14
• >= 1.7, < 1.7.11
• from 0, < 316bc3fc9437c5960c24baceb93c73f1939711e4 | from 0, < 1.7.11, >= 1.8, < 1.8.7, >= 1.9a0, < 1.9rc2

CVSS scores

References (23)

• ADVISORYgithub.com/advisories/GHSA-6wcr-wcqm-3mfh
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-8213
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2015-8213
• ADVISORYwww.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
• PATCH