Bug 865164 (CVE-2012-4520)

Summary: CVE-2012-4520 Django: Host header poisoning vulnerability
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bkearney, jomara, katello-bugs, markmc, nsantos, sclewis, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20121017,reported=20121010,source=upstream,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N,epel-6/Django=affected,epel-5/Django=notaffected,fedora-all/Django=affected,openstack-1/Django=wontfix,sam-1/Django=affected
Fixed In Version: Django 1.3.4, Django 1.4.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-24 06:56:44 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 867731, 867732, 867733, 1015745    
Bug Blocks: 865165    
Attachments:
Description Flags
Upstream patch to correct the flaw in Django 1.3.x.
none
Upstream patch to correct the flaw in Django 1.4.x. none

Description Vincent Danen 2012-10-10 18:09:28 EDT
It was reported that Django's built-in parsing of the Host header was incorrectly handling username/password information (in django.http.HttpRequest.get_host()).  This could allow a remote attacker to cause parts of Django, in particular the password-reset mechanism, to generate and display arbitrary URLs to end-users.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this vulnerability.
Comment 1 Vincent Danen 2012-10-10 18:11:25 EDT
Created attachment 625210 [details]
Upstream patch to correct the flaw in Django 1.3.x.
Comment 2 Vincent Danen 2012-10-10 18:11:50 EDT
Created attachment 625211 [details]
Upstream patch to correct the flaw in Django 1.4.x.
Comment 3 Vincent Danen 2012-10-11 16:26:35 EDT
This has been assigned the name CVE-2012-4520.
Comment 4 Kurt Seifried 2012-10-18 04:09:09 EDT
This is now public https://www.djangoproject.com/weblog/2012/oct/17/security/
Comment 6 Kurt Seifried 2012-10-18 04:12:25 EDT
Created Django tracking bugs for this issue

Affects: fedora-all [bug 867732]
Comment 7 Kurt Seifried 2012-10-18 04:13:07 EDT
Created Django tracking bugs for this issue

Affects: epel-6 [bug 867733]