PT-2012-5457 · Django · Django

James Kettle · Publicado 2012-11-18 · Atualizado 2022-05-17 · CVE-2012-4520

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.3.x through 1.3.3 Django versions 1.4.x through 1.4.1

Description The issue allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values in the django.http.HttpRequest.get host function.

Recommendations For Django versions 1.3.x through 1.3.3, update to version 1.3.4 or later. For Django versions 1.4.x through 1.4.1, update to version 1.4.2 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-4520

DSA-2634-1

GHSA-2655-Q453-22F9

PYSEC-2012-7

Produtos afetados

Django

Referências · 34

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/9305c0e12d43c4df999c3301a1f0c742264a657e · Nota
• https://github.com/django/django/commit/92d3430f12171f16f566c9050c40feefb830a4a3 · Nota
• https://github.com/django/django/commit/b45c377f8f488955e0c7069cad3f3dd21910b071 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-7.yaml · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-4520 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1757-1 · Aviso do Fabricante
• https://djangoproject.com/weblog/2012/oct/17/security · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4520 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1632-1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090970.html · Aviso do Fabricante
• http://osvdb.org/86493 · Nota
• http://secunia.com/advisories/51033 · Aviso do Fabricante
• https://ubuntu.com/usn/usn-1632-1 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145 · Nota