~ / search / GHSA-7qfw-j7hp-v45g

GHSA-7qfw-j7hp-v45g

Django WSGI Header Spoofing Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-0219

Packages

EcosystemPackageAffectedFixed in
PyPI Django < 1.4.18 1.4.18
PyPI Django >= 1.6, < 1.6.10 1.6.10
PyPI Django >= 1.7, < 1.7.3 1.7.3

Details

As written in the advisory (Markdown source, shown as plain text).

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X-Auth_User` header.

References

External links from the advisory. They lead to third-party sites.