| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 1.7, < 1.7.11≥ 1.8, < 1.8.7≥ 1.8a1, < 1.8.7≥ 1.9a0, < 1.9rc2≥ 1.9a1, < 1.9rc2< 1.7.11 | 1.7.111.8.71.9rc2 |
| django | = 1.8.0= 1.8.1= 1.8.2= 1.8.3= 1.8.4= 1.8.5= 1.8.6= 1.9.0≤ 1.7.10 |
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free