Bug 1239011 (CVE-2015-5144)

The following flaw was found in Django:

Some of Django's built-in validators ('django.core.validators.EmailValidator', most seriously) didn't prohibit newline characters (due to the usage of '$' instead of '\Z' in the regular expressions). If an application uses values with newlines in HTTP response or email headers, it can allow an attacker to perform header injection attacks. Django itself isn't vulnerable because 'django.http.HttpResponse' and the mail sending utilities in 'django.core.mail' prohibit newlines in HTTP and SMTP headers, respectively.

While the validators have been fixed in Django, when creating HTTP responses or email messages in other ways, ensure that those methods prohibit newlines as well. Any already-existing data in your application should be checked whether it contains unexpected newlines.

'django.core.validators.validate_ipv4_address()', 'django.core.validators.validate_slug()', and 'django.core.validators.URLValidator' are also affected, however, as of Django 1.6 the 'GenericIPAddresseField', 'IPAddressField', 'SlugField', and 'URLField' form fields which use these validators all strip the input, so the possibility of newlines entering your data only exists if you are using these validators outside of the form fields

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.