Bug 1239011 (CVE-2015-5144) - CVE-2015-5144 Django: possible header injection due to validators accepting newlines in input
Summary: CVE-2015-5144 Django: possible header injection due to validators accepting n...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-5144
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1242350 1242719 1242720 1242721 1242722
Blocks: 1239014
TreeView+ depends on / blocked
 
Reported: 2015-07-03 09:10 UTC by Martin Prpič
Modified: 2019-09-29 13:34 UTC (History)
22 users (show)

Fixed In Version: Django 1.8.3, Django 1.7.9, Django 1.4.21
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-25 07:27:49 UTC


Attachments (Terms of Use)
newlines-1.4.x.diff (8.19 KB, text/plain)
2015-07-07 07:56 UTC, Martin Prpič
no flags Details
newlines-1.7.x.diff (10.14 KB, text/plain)
2015-07-07 07:56 UTC, Martin Prpič
no flags Details
newlines-1.8.x.diff (12.29 KB, text/plain)
2015-07-07 07:56 UTC, Martin Prpič
no flags Details
newlines-master.diff (11.93 KB, text/plain)
2015-07-07 07:56 UTC, Martin Prpič
no flags Details

Description Martin Prpič 2015-07-03 09:10:36 UTC
The following flaw was found in Django:

Some of Django's built-in validators ('django.core.validators.EmailValidator', most seriously) didn't prohibit newline characters (due to the usage of '$' instead of '\Z' in the regular expressions). If an application uses values with newlines in HTTP response or email headers, it can allow an attacker to perform header injection attacks. Django itself isn't vulnerable because 'django.http.HttpResponse' and the mail sending utilities in 'django.core.mail' prohibit newlines in HTTP and SMTP headers, respectively.

While the validators have been fixed in Django, when creating HTTP responses or email messages in other ways, ensure that those methods prohibit newlines as well. Any already-existing data in your application should be checked whether it contains unexpected newlines.

'django.core.validators.validate_ipv4_address()', 'django.core.validators.validate_slug()', and 'django.core.validators.URLValidator' are also affected, however, as of Django 1.6 the 'GenericIPAddresseField', 'IPAddressField', 'SlugField', and 'URLField' form fields which use these validators all strip the input, so the possibility of newlines entering your data only exists if you are using these validators outside of the form fields

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this issue.

Comment 1 Martin Prpič 2015-07-07 07:56:44 UTC
Created attachment 1049127 [details]
newlines-1.4.x.diff

Comment 2 Martin Prpič 2015-07-07 07:56:46 UTC
Created attachment 1049128 [details]
newlines-1.7.x.diff

Comment 3 Martin Prpič 2015-07-07 07:56:49 UTC
Created attachment 1049129 [details]
newlines-1.8.x.diff

Comment 4 Martin Prpič 2015-07-07 07:56:52 UTC
Created attachment 1049130 [details]
newlines-master.diff

Comment 5 Kurt Seifried 2015-07-09 04:38:16 UTC
This is now public: https://www.djangoproject.com/weblog/2015/jul/08/security-releases/

Comment 7 Garth Mollett 2015-07-14 03:18:25 UTC
Created Django14 tracking bugs for this issue:

Affects: epel-6 [bug 1242722]

Comment 8 Garth Mollett 2015-07-14 03:18:29 UTC
Created python-django tracking bugs for this issue:

Affects: openstack-rdo [bug 1242719]
Affects: fedora-all [bug 1242720]
Affects: epel-7 [bug 1242721]

Comment 9 Garth Mollett 2015-07-15 00:59:46 UTC
Statement:

This issue affects the version of python-django as included with Red Hat Enterprise Linux OpenStack Platform 5 and 6 however there is no known security impact in a supported use-case at this time.

A future update may address this issue.

Comment 10 Fedora Update System 2015-07-23 08:54:30 UTC
python-django-1.8.3-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.