{"action":"Upgrade django to 1.4.21 or later.","affected":[{"fixed":"1.4.21","introduced":"0"},{"fixed":"1.7.9","introduced":"1.5"},{"fixed":"1.8.3","introduced":"1.8a1"}],"component":"django","cve_ids":["CVE-2015-5144"],"ecosystem":"PyPI","epss":0.0319,"exploited":false,"fixed_versions":["1.4.21","1.7.9","1.8.3"],"ghsa_id":"GHSA-q5qw-4364-5hhm","id":"tcs_01M5KFVE39S4J6PCTBERPY031W","modified_at":"2025-02-19T05:41:17.309735Z","published_at":"2022-05-17T00:48:30Z","references":["https://osv.dev/vulnerability/GHSA-q5qw-4364-5hhm","https://nvd.nist.gov/vuln/detail/CVE-2015-5144","https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a","https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0","https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c","https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649","https://github.com/django/django","https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54","https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml","https://security.gentoo.org/glsa/201510-06","https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820","https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665","https://www.djangoproject.com/weblog/2015/jul/08/security-releases","http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html","http://www.debian.org/security/2015/dsa-3305","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.ubuntu.com/usn/USN-2671-1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q5qw-4364-5hhm","url":"https://osv.dev/vulnerability/GHSA-q5qw-4364-5hhm"}],"summary":"Django Vulnerable to HTTP Response Splitting Attack"}