The following flaw was found in Django:
Some of Django's built-in validators ('django.core.validators.EmailValidator', most seriously) didn't prohibit newline characters (due to the usage of '$' instead of '\Z' in the regular expressions). If an application uses values with newlines in HTTP response or email headers, it can allow an attacker to perform header injection attacks. Django itself isn't vulnerable because 'django.http.HttpResponse' and the mail sending utilities in 'django.core.mail' prohibit newlines in HTTP and SMTP headers, respectively.
While the validators have been fixed in Django, when creating HTTP responses or email messages in other ways, ensure that those methods prohibit newlines as well. Any already-existing data in your application should be checked whether it contains unexpected newlines.
'django.core.validators.validate_ipv4_address()', 'django.core.validators.validate_slug()', and 'django.core.validators.URLValidator' are also affected, however, as of Django 1.6 the 'GenericIPAddresseField', 'IPAddressField', 'SlugField', and 'URLField' form fields which use these validators all strip the input, so the possibility of newlines entering your data only exists if you are using these validators outside of the form fields
Red Hat would like to thank the upstream Django project for reporting this issue.
Created attachment 1049127 [details]
Created attachment 1049128 [details]
Created attachment 1049129 [details]
Created attachment 1049130 [details]
This is now public: https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
Created Django14 tracking bugs for this issue:
Affects: epel-6 [bug 1242722]
Created python-django tracking bugs for this issue:
Affects: openstack-rdo [bug 1242719]
Affects: fedora-all [bug 1242720]
Affects: epel-7 [bug 1242721]
This issue affects the version of python-django as included with Red Hat Enterprise Linux OpenStack Platform 5 and 6 however there is no known security impact in a supported use-case at this time.
A future update may address this issue.
python-django-1.8.3-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.