This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 865164 - (CVE-2012-4520) CVE-2012-4520 Django: Host header poisoning vulnerability
CVE-2012-4520 Django: Host header poisoning vulnerability
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20121017,repor...
: Security
Depends On: 867731 867732 867733 1015745
Blocks: 865165
  Show dependency treegraph
 
Reported: 2012-10-10 18:09 EDT by Vincent Danen
Modified: 2016-04-26 12:02 EDT (History)
7 users (show)

See Also:
Fixed In Version: Django 1.3.4, Django 1.4.2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-24 06:56:44 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Upstream patch to correct the flaw in Django 1.3.x. (8.28 KB, patch)
2012-10-10 18:11 EDT, Vincent Danen
no flags Details | Diff
Upstream patch to correct the flaw in Django 1.4.x. (8.20 KB, patch)
2012-10-10 18:11 EDT, Vincent Danen
no flags Details | Diff

  None (edit)
Description Vincent Danen 2012-10-10 18:09:28 EDT
It was reported that Django's built-in parsing of the Host header was incorrectly handling username/password information (in django.http.HttpRequest.get_host()).  This could allow a remote attacker to cause parts of Django, in particular the password-reset mechanism, to generate and display arbitrary URLs to end-users.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this vulnerability.
Comment 1 Vincent Danen 2012-10-10 18:11:25 EDT
Created attachment 625210 [details]
Upstream patch to correct the flaw in Django 1.3.x.
Comment 2 Vincent Danen 2012-10-10 18:11:50 EDT
Created attachment 625211 [details]
Upstream patch to correct the flaw in Django 1.4.x.
Comment 3 Vincent Danen 2012-10-11 16:26:35 EDT
This has been assigned the name CVE-2012-4520.
Comment 4 Kurt Seifried 2012-10-18 04:09:09 EDT
This is now public https://www.djangoproject.com/weblog/2012/oct/17/security/
Comment 6 Kurt Seifried 2012-10-18 04:12:25 EDT
Created Django tracking bugs for this issue

Affects: fedora-all [bug 867732]
Comment 7 Kurt Seifried 2012-10-18 04:13:07 EDT
Created Django tracking bugs for this issue

Affects: epel-6 [bug 867733]

Note You need to log in before you can comment on or make changes to this bug.