Bug 1179672 (CVE-2015-0219) - CVE-2015-0219 Django: WSGI header spoofing via underscore/dash conflation
Summary: CVE-2015-0219 Django: WSGI header spoofing via underscore/dash conflation
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-0219
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1181939 1181940 1181941 1181942
Blocks: 1179508
TreeView+ depends on / blocked
 
Reported: 2015-01-07 10:04 UTC by Martin Prpič
Modified: 2021-02-17 05:51 UTC (History)
22 users (show)

Fixed In Version: Django 1.7.3, Django 1.6.10, Django 1.4.18
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-14 10:38:05 UTC


Attachments (Terms of Use)
headers-1.4.x.patch (5.31 KB, text/plain)
2015-01-07 10:13 UTC, Martin Prpič
no flags Details
headers-1.6.x.patch (8.30 KB, text/plain)
2015-01-07 10:13 UTC, Martin Prpič
no flags Details
headers-1.7.x.patch (9.91 KB, text/plain)
2015-01-07 10:13 UTC, Martin Prpič
no flags Details
headers-master.patch (9.91 KB, text/plain)
2015-01-07 10:13 UTC, Martin Prpič
no flags Details

Description Martin Prpič 2015-01-07 10:04:27 UTC
The Django project reports the following issue:

"""
When HTTP headers are placed into the WSGI environ, they are normalized by converting to uppercase, converting all dashes to underscores, and prepending `HTTP_`. For instance, a header ``X-Auth-User`` would become ``HTTP_X_AUTH_USER`` in the WSGI environ (and thus also in Django's ``request.META`` dictionary).

Unfortunately, this means that the WSGI environ cannot distinguish between headers containing dashes and headers containing underscores: ``X-Auth-User`` and ``X-Auth_User`` both become ``HTTP_X_AUTH_USER``. This means that if a header is used in a security-sensitive way (for instance, passing authentication information along from a front-end proxy), even if the proxy carefully strips any incoming value for ``X-Auth-User``, an attacker may be able to provide an ``X-Auth_User`` header (with underscore) and bypass this protection.

In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Django's built-in development server now does the same. Django's development server is not recommended for production use, but matching the behavior of common production servers reduces the surface area for behavior changes during deployment.
"""

This issue is resolved in the upstream versions 1.7.3, 1.6.10, and 1.4.18. Note that Django 1.5 is no longer receiving security updates.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.

Comment 1 Martin Prpič 2015-01-07 10:13:30 UTC
Created attachment 977180 [details]
headers-1.4.x.patch

Comment 2 Martin Prpič 2015-01-07 10:13:33 UTC
Created attachment 977181 [details]
headers-1.6.x.patch

Comment 3 Martin Prpič 2015-01-07 10:13:36 UTC
Created attachment 977182 [details]
headers-1.7.x.patch

Comment 4 Martin Prpič 2015-01-07 10:13:39 UTC
Created attachment 977183 [details]
headers-master.patch

Comment 5 Martin Prpič 2015-01-14 07:25:39 UTC
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1181942]

Comment 6 Martin Prpič 2015-01-14 07:25:44 UTC
Created python-django14 tracking bugs for this issue:

Affects: fedora-20 [bug 1181940]

Comment 7 Martin Prpič 2015-01-14 07:25:47 UTC
Created python-django tracking bugs for this issue:

Affects: fedora-all [bug 1181939]
Affects: epel-7 [bug 1181941]

Comment 8 Martin Prpič 2015-01-14 07:29:01 UTC
External References:

https://www.djangoproject.com/weblog/2015/jan/13/security/

Comment 9 Fedora Update System 2015-01-26 02:32:30 UTC
python-django-1.6.10-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2015-01-27 03:00:15 UTC
python-django14-1.4.18-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2015-01-27 03:05:58 UTC
python-django-1.6.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2015-02-05 19:01:41 UTC
python-django-1.6.10-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Matthias Runge 2016-06-14 10:38:05 UTC
all related bz have been closed.


Note You need to log in before you can comment on or make changes to this bug.