It was reported that Django's built-in parsing of the Host header was incorrectly handling username/password information (in django.http.HttpRequest.get_host()).  This could allow a remote attacker to cause parts of Django, in particular the password-reset mechanism, to generate and display arbitrary URLs to end-users.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this vulnerability.