PT-2011-4857 · Django Software Foundation · Django

Jan Lieskovsky · Publicado 2011-10-19 · Atualizado 2022-05-14 · CVE-2011-4139

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.2.7 Django versions 1.3.x prior to 1.3.1

Description The issue allows remote attackers to conduct cache poisoning attacks by crafting a request that exploits how Django constructs a full URL using a request's HTTP Host header in certain circumstances.

Recommendations For Django versions prior to 1.2.7, update to version 1.2.7 or later. For Django versions 1.3.x prior to 1.3.1, update to version 1.3.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-349

Identificadores relacionados

CVE-2011-4139

DSA-2332-1

GHSA-RM2J-X595-Q9CJ

PYSEC-2011-4

Produtos afetados

Django

Referências · 18

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/2f7fadc38efa58ac0a8f93f936b82332a199f396 · Nota
• https://github.com/django/django/commit/c613af4d6485586c79d692b70a9acac429f3ca9d · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-4.yaml · Nota
• https://djangoproject.com/weblog/2011/sep/09 · Aviso do Fabricante
• https://djangoproject.com/weblog/2011/sep/10/127 · Correção
• http://openwall.com/lists/oss-security/2011/09/13/2 · Correção
• https://osv.dev/vulnerability/PYSEC-2011-4 · Aviso do Fabricante
• https://hermes.opensuse.org/messages/14700881 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4139 · Nota de Segurança
• http://debian.org/security/2011/dsa-2332 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=737366 · Correção
• http://openwall.com/lists/oss-security/2011/09/11/1 · Correção
• https://osv.dev/vulnerability/GHSA-rm2j-x595-q9cj · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4139 · Aviso do Fabricante