PyPI/django CVE-2015-5144: high 7.5, EPSS 3.19%

Django Vulnerable to HTTP Response Splitting Attack

Action: Upgrade django to 1.4.21 or later.

pip install django==1.4.21

pip install django==1.7.9

pip install django==1.8.3

Affected

Fixed versions

Sources

• osv: GHSA-q5qw-4364-5hhm
• https://nvd.nist.gov/vuln/detail/CVE-2015-5144
• https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a
• https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0
• https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c
• https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649
• https://github.com/django/django
• https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml
• https://security.gentoo.org/glsa/201510-06
• https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820
• https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665
• https://www.djangoproject.com/weblog/2015/jul/08/security-releases
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
• http://www.debian.org/security/2015/dsa-3305
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
• http://www.ubuntu.com/usn/USN-2671-1

CVE-2015-5144 · published 2022-05-17T00:48:30Z · modified 2025-02-19T05:41:17.309735Z · JSON