Django settings leak in date template filter
Moderate severity
GitHub Reviewed
Published
May 17, 2022
to the GitHub Advisory Database
•
Updated Mar 8, 2024
Package
Affected versions
>= 1.7, < 1.7.11
>= 1.8, < 1.8.7
>= 1.9a1, < 1.9rc2
Patched versions
1.7.11
1.8.7
1.9rc2
Description
Published by the National Vulnerability Database
Dec 7, 2015
Published to the GitHub Advisory Database
May 17, 2022
Reviewed
Mar 8, 2024
Last updated
Mar 8, 2024
Credits
-
sunSUNQ Analyst
The get_format function in
utils/formats.pyin Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated bySECRET_KEY.References