FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
11c52bc6-97aa-11e5-b8df-14dae9d210b8django -- information leak vulnerability

Tim Graham reports:

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".


Discovery 2015-11-24
Entry 2015-11-30
Modified 2015-12-24
py27-django
py32-django
py33-django
py34-django
lt 1.8.7

py27-django18
py32-django18
py33-django18
py34-django18
lt 1.8.7

py27-django17
py32-django17
py33-django17
py34-django17
lt 1.7.11

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
CVE-2015-8213
b0e54dc1-45d2-11e5-adde-14dae9d210b8django -- multiple vulnerabilities

Tim Graham reports:

Denial-of-service possibility in logout() view by filling session store

Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted.

The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records.

This portion of the fix has been assigned CVE-2015-5963.

Additionally, on the 1.4 and 1.7 series only, the contrib.sessions.backends.base.SessionBase.flush() and cache_db.SessionStore.flush() methods have been modified to avoid creating a new empty session. Maintainers of third-party session backends should check if the same vulnerability is present in their backend and correct it if so.

This portion of the fix has been assigned CVE-2015-5964. Anyone reporting a similar vulnerability in a third-party session backend should not use this CVE ID.

Thanks Lin Hua Cheng for reporting the issue.


Discovery 2015-08-18
Entry 2015-08-18
py27-django
py32-django
py33-django
py34-django
lt 1.8.4

py27-django17
py32-django17
py33-django17
py34-django17
lt 1.7.10

py27-django14
py32-django14
py33-django14
py34-django14
lt 1.4.22

py27-django-devel
py32-django-devel
py33-django-devel
py34-django-devel
le 20150709,1

https://www.djangoproject.com/weblog/2015/aug/18/security-releases/
CVE-2015-5963
CVE-2015-5964