CVE-2015-5144
- State
- Published
- Severity
- Not scored
- Published
- Jul 14, 2015
- Updated
- Aug 6, 2024
- Reserved
- Jun 29, 2015
Description
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- FEDORA-2015-1dd5bc998fvendor-advisory
- GLSA-201510-06vendor-advisory
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- openSUSE-SU-2015:1802vendor-advisory
- openSUSE-SU-2015:1813vendor-advisory
- DSA-3305vendor-advisory
- 75665vdb-entry
- USN-2671-1vendor-advisory
- 1032820vdb-entry
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.