Vulnerability advisory

PYSEC-2011-5

Published Oct 19, 2011Updated Nov 8, 2023OSV record ↗

Also known as CVE-2011-4140GHSA-h95j-h2rv-qrg4

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
All versions before 1.2.7	`1.2.7`Advisories →
`1.3` to before 1.3.1	`1.3.1`Advisories →
Also listed as affected (17) `1.0.1` `1.0.2` `1.0.3` `1.0.4` `1.1` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.2` `1.2.1` `1.2.2` `1.2.3` `1.2.4` `1.2.5` `1.2.6` `1.3`

Description

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.

References

Reportbugzilla.redhat.com/show_bug.cgi?id=737366 ↗
Webopenwall.com/lists/oss-security/2011/09/11/1 ↗
ARTICLEwww.djangoproject.com/weblog/2011/sep/09/ ↗
Webopenwall.com/lists/oss-security/2011/09/13/2 ↗
ARTICLEwww.djangoproject.com/weblog/2011/sep/10/127/ ↗
Advisorysecunia.com/advisories/46614 ↗
Advisorywww.debian.org/security/2011/dsa-2332 ↗
Webhermes.opensuse.org/messages/14700881 ↗
Advisorygithub.com/advisories/GHSA-h95j-h2rv-qrg4 ↗