Bug 865164 (CVE-2012-4520)

Summary: CVE-2012-4520 Django: Host header poisoning vulnerability
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bkearney, jomara, katello-bugs, markmc, nsantos, sclewis, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Django 1.3.4, Django 1.4.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-24 10:56:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 867731, 867732, 867733, 1015745    
Bug Blocks: 865165    
Attachments:
Description Flags
Upstream patch to correct the flaw in Django 1.3.x.
none
Upstream patch to correct the flaw in Django 1.4.x. none

Description Vincent Danen 2012-10-10 22:09:28 UTC
It was reported that Django's built-in parsing of the Host header was incorrectly handling username/password information (in django.http.HttpRequest.get_host()).  This could allow a remote attacker to cause parts of Django, in particular the password-reset mechanism, to generate and display arbitrary URLs to end-users.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this vulnerability.

Comment 1 Vincent Danen 2012-10-10 22:11:25 UTC
Created attachment 625210 [details]
Upstream patch to correct the flaw in Django 1.3.x.

Comment 2 Vincent Danen 2012-10-10 22:11:50 UTC
Created attachment 625211 [details]
Upstream patch to correct the flaw in Django 1.4.x.

Comment 3 Vincent Danen 2012-10-11 20:26:35 UTC
This has been assigned the name CVE-2012-4520.

Comment 4 Kurt Seifried 2012-10-18 08:09:09 UTC
This is now public https://www.djangoproject.com/weblog/2012/oct/17/security/

Comment 6 Kurt Seifried 2012-10-18 08:12:25 UTC
Created Django tracking bugs for this issue

Affects: fedora-all [bug 867732]

Comment 7 Kurt Seifried 2012-10-18 08:13:07 UTC
Created Django tracking bugs for this issue

Affects: epel-6 [bug 867733]