CVE-2015-2317: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 5% chance of exploitation in the next 30 days.

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 14.04 only; version 14.10 only
• Debian Debian Linux: version 7.0 only
• Djangoproject Django: up to and including 1.4.19; version 1.5 only; version 1.5.1 only; version 1.5.2 only; version 1.5.3 only; version 1.5.4 only; …
• Fedoraproject Fedora: version 22 only
• Opensuse Opensuse: version 13.2 only
• Oracle Solaris: version 11.2 only

Published 2015-03-25. Last modified 2026-06-17.