Bug 865164 (CVE-2012-4520) - CVE-2012-4520 Django: Host header poisoning vulnerability
Summary: CVE-2012-4520 Django: Host header poisoning vulnerability
Status: CLOSED CURRENTRELEASE
Alias: CVE-2012-4520
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20121017,repor...
Keywords: Security
Depends On: 867731 867732 867733 1015745
Blocks: 865165
TreeView+ depends on / blocked
 
Reported: 2012-10-10 22:09 UTC by Vincent Danen
Modified: 2016-04-26 16:02 UTC (History)
7 users (show)

Fixed In Version: Django 1.3.4, Django 1.4.2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-24 10:56:44 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Upstream patch to correct the flaw in Django 1.3.x. (8.28 KB, patch)
2012-10-10 22:11 UTC, Vincent Danen
no flags Details | Diff
Upstream patch to correct the flaw in Django 1.4.x. (8.20 KB, patch)
2012-10-10 22:11 UTC, Vincent Danen
no flags Details | Diff

Description Vincent Danen 2012-10-10 22:09:28 UTC
It was reported that Django's built-in parsing of the Host header was incorrectly handling username/password information (in django.http.HttpRequest.get_host()).  This could allow a remote attacker to cause parts of Django, in particular the password-reset mechanism, to generate and display arbitrary URLs to end-users.

Acknowledgements:

Red Hat would like to thank the upstream Django project for reporting this vulnerability.

Comment 1 Vincent Danen 2012-10-10 22:11:25 UTC
Created attachment 625210 [details]
Upstream patch to correct the flaw in Django 1.3.x.

Comment 2 Vincent Danen 2012-10-10 22:11:50 UTC
Created attachment 625211 [details]
Upstream patch to correct the flaw in Django 1.4.x.

Comment 3 Vincent Danen 2012-10-11 20:26:35 UTC
This has been assigned the name CVE-2012-4520.

Comment 4 Kurt Seifried 2012-10-18 08:09:09 UTC
This is now public https://www.djangoproject.com/weblog/2012/oct/17/security/

Comment 6 Kurt Seifried 2012-10-18 08:12:25 UTC
Created Django tracking bugs for this issue

Affects: fedora-all [bug 867732]

Comment 7 Kurt Seifried 2012-10-18 08:13:07 UTC
Created Django tracking bugs for this issue

Affects: epel-6 [bug 867733]


Note You need to log in before you can comment on or make changes to this bug.