The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and…
Priority LOW 31CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.
Summary
The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Why it matters now
EPSS 0.04826 92nd percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.6.11, 1.7.7, 1.8c1Red Hat: 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 1.6 to before 1.6.11 | 1.6.11 | Patch available | GHSA-j3j3-jrfh-cm2w |
| — | Django (PyPI) | 1.7 to before 1.7.7 | 1.7.7 | Patch available | GHSA-j3j3-jrfh-cm2w |
| — | Django (PyPI) | 1.8a1 to before 1.8c1 | 1.8c1 | Patch available | GHSA-j3j3-jrfh-cm2w |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 1.6 to before 1.6.11 Fixed in 1.6.11 Patch available GHSA-j3j3-jrfh-cm2w
- Django (PyPI) Vendor— Affected 1.7 to before 1.7.7 Fixed in 1.7.7 Patch available GHSA-j3j3-jrfh-cm2w
- Django (PyPI) Vendor— Affected 1.8a1 to before 1.8c1 Fixed in 1.8c1 Patch available GHSA-j3j3-jrfh-cm2w
CPE configurations NVD · 36
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:* | 11.2 | Vulnerable | Oracle |
| cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:* | 1.6 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:* | 1.6 beta1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:* | 1.6 beta2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:* | 1.6 beta3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:* | 1.6 beta4 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:* | 1.6.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:* | 1.6.3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:* | 1.6.4 | Vulnerable | djangoproject |
- cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·Oracle
- cpe:2.3:a:djangoproject:django:1.6:-:*:*:*:*:*:* Versions 1.6 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6:beta1:*:*:*:*:*:* Versions 1.6 beta1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6:beta2:*:*:*:*:*:* Versions 1.6 beta2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6:beta3:*:*:*:*:*:* Versions 1.6 beta3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6:beta4:*:*:*:*:*:* Versions 1.6 beta4 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·djangoproject
Show 26 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:* | 1.6.5 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:* | 1.6.6 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:* | 1.6.7 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:* | 1.6.8 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:* | 1.6.9 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.6.10:*:*:*:*:*:*:* | 1.6.10 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:* | 1.7 beta1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:* | 1.7 beta2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:* | 1.7 beta3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:beta4:*:*:*:*:*:* | 1.7 beta4 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:rc1:*:*:*:*:*:* | 1.7 rc1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:rc2:*:*:*:*:*:* | 1.7 rc2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7:rc3:*:*:*:*:*:* | 1.7 rc3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:* | 1.7.1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:* | 1.7.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.3:*:*:*:*:*:*:* | 1.7.3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.4:*:*:*:*:*:*:* | 1.7.4 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.5:*:*:*:*:*:*:* | 1.7.5 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.7.6:*:*:*:*:*:*:* | 1.7.6 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | djangoproject |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* | 14.10 | Vulnerable | Canonical |
| cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* | 22 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | openSUSE |
- cpe:2.3:a:djangoproject:django:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.6.10:*:*:*:*:*:*:* Versions 1.6.10 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:beta1:*:*:*:*:*:* Versions 1.7 beta1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:beta2:*:*:*:*:*:* Versions 1.7 beta2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:beta3:*:*:*:*:*:* Versions 1.7 beta3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:beta4:*:*:*:*:*:* Versions 1.7 beta4 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:rc1:*:*:*:*:*:* Versions 1.7 rc1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:rc2:*:*:*:*:*:* Versions 1.7 rc2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7:rc3:*:*:*:*:*:* Versions 1.7 rc3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·djangoproject
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·Canonical
- cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
Remediation
- Fix · GHSA-j3j3-jrfh-cm2w Django (PyPI) Fixed in 1.6.11 Advisory →
- Fix · GHSA-j3j3-jrfh-cm2w Django (PyPI) Fixed in 1.7.7 Advisory →
- Fix · GHSA-j3j3-jrfh-cm2w Django (PyPI) Fixed in 1.8c1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux OpenStack Platform 6 (Juno) | Affected | No fix yet: Fix deferred |
Not affected: 2 products
- Red Hat OpenStack Platform 4
- Red Hat Subscription Asset Manager
Timeline
- 2026-10-02 Threatist record created from CVE-2015-2316
- 2026-10-03 Alias added: GHSA-j3j3-jrfh-cm2w
References
Advisory 5
Other 7
- https://github.com/django/django/commit/5447709a571cd5d95971f1d5d21d4a7edcf85bbd
- https://github.com/django/django/commit/b6b3cb9899214a23ebb0f4ebf0e0b300b0ee524f
- https://github.com/django/django/commit/e63363f8e075fa8d66326ad6a1cc3391cc95cd97
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-18.yaml
- https://web.archive.org/web/20200229033201/http://www.securityfocus.com/bid/73322
- https://www.djangoproject.com/weblog/2015/mar/18/security-releases
Sources
- CVE-2015-2316 · CVE Program
- CVE-2015-2316 · NVD
- FIRST EPSS
- GHSA-j3j3-jrfh-cm2w · GitHub Advisory Database · CC BY 4.0
- CVE-2015-2316 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences