Bug 1097505 (CVE-2014-3730)

A redirect issue was reported in Django. This could lead to a victim being redirected to an arbitrary site. The original report from upstream:

""
The validation for redirects did not correctly validate some malformed
URLs, which are accepted by some browsers. This allows a user to be
redirected to an unsafe URL unexpectedly.

Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``,
and :doc:`i18n </topics/i18n/index>`) to redirect the user to an "on
success" URL. The security checks for these redirects (namely
``django.util.http.is_safe_url()``) did not correctly validate some
malformed URLs, such as `http:\\\\\\djangoproject.com`, which are
accepted by some browsers with more liberal URL parsing.

To remedy this, the validation in ``is_safe_url()`` has been tightened
to be able to handle and correctly validate these malformed URLs.
""

This issue affects Django versions 1.4, 1.5, 1.6, and 1.7. It has been fixed in versions 1.4.13, 1.5.8, 1.6.5, and 1.7 beta 4.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue. Upstream acknowledges Peter Kuma and Gavin Wahl as the original reporters.