CVE-2015-2316

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

Published: Mar 25, 2015
Updated: Apr 13, 2023
CVE: CVE-2015-2316
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:N/A:P

CWEs:

CWE-399

Affected Software
References

Software	From	Fixed in
oracle / solaris	11.2	11.2.x
djangoproject / django	1.7.5	1.7.5.x
djangoproject / django	1.7.3	1.7.3.x
djangoproject / django	1.6-beta4	1.6-beta4.x
djangoproject / django	1.6.7	1.6.7.x
djangoproject / django	1.7-rc2	1.7-rc2.x
djangoproject / django	1.7-beta1	1.7-beta1.x
djangoproject / django	1.6.5	1.6.5.x
djangoproject / django	1.6-beta2	1.6-beta2.x
djangoproject / django	1.7-beta3	1.7-beta3.x
djangoproject / django	1.6.8	1.6.8.x
djangoproject / django	1.6.6	1.6.6.x
djangoproject / django	1.7.2	1.7.2.x
djangoproject / django	1.7.4	1.7.4.x
djangoproject / django	1.6.10	1.6.10.x
djangoproject / django	1.6.3	1.6.3.x
djangoproject / django	1.7.6	1.7.6.x
djangoproject / django	1.8.0	1.8.0.x
djangoproject / django	1.7-rc3	1.7-rc3.x
djangoproject / django	1.6.4	1.6.4.x
djangoproject / django	1.6	1.6.x
djangoproject / django	1.6.1	1.6.1.x
djangoproject / django	1.6.2	1.6.2.x
djangoproject / django	1.6-beta1	1.6-beta1.x
djangoproject / django	1.6-beta3	1.6-beta3.x
djangoproject / django	1.7-rc1	1.7-rc1.x
djangoproject / django	1.6.9	1.6.9.x
djangoproject / django	1.7.1	1.7.1.x
djangoproject / django	1.7-beta2	1.7-beta2.x
djangoproject / django	1.7-beta4	1.7-beta4.x
fedoraproject / fedora	22	22.x
canonical / ubuntu_linux	12.04	12.04.x
canonical / ubuntu_linux	14.10	14.10.x
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	10.04	10.04.x
opensuse / opensuse	13.2	13.2.x

Vulnerability Database

289,689

CVE-2015-2316