Severity
Severity not reported.
Affected versions
No affected versions listed.
Description
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
References
- Advisoryadvisories.mageia.org/MGASA-2015-0026.html ↗
- Advisorysecunia.com/advisories/62285 ↗
- Advisorysecunia.com/advisories/62309 ↗
- Advisorysecunia.com/advisories/62718 ↗
- Advisorywww.mandriva.com/security/advisories?name=MDVSA-2015:036 ↗
- Advisorywww.mandriva.com/security/advisories?name=MDVSA-2015:109 ↗
- Advisorywww.ubuntu.com/usn/USN-2469-1 ↗
- Advisorywww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- EVIDENCEwww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- Fixwww.ubuntu.com/usn/USN-2469-1 ↗
- Fixwww.djangoproject.com/weblog/2015/jan/13/security/ ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html ↗
- Weblists.fedoraproject.org/pipermail/package-announce/2015-January/148696.html ↗
- Weblists.opensuse.org/opensuse-updates/2015-04/msg00001.html ↗
- Weblists.opensuse.org/opensuse-updates/2015-09/msg00035.html ↗