CVE-2015-5144
medium
CVSS v3
—
CVSS v2
4.3
VIR risk
4.3
Description
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-5144
Vendor advisory: cve@mitre.org — https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| ubuntu | 12.04 | affected | |
| ubuntu | 14.04 | affected | |
| ubuntu | 15.04 | affected | |
| ubuntu | 15.10 | affected | |
| debian | 7.0 | affected | |
| debian | 8.0 | affected | |
| debian | bookworm | fixed | 1.7.9-1 |
| debian | bullseye | fixed | 1.7.9-1 |
| debian | forky | fixed | 1.7.9-1 |
| debian | sid | fixed | 1.7.9-1 |
| debian | trixie | fixed | 1.7.9-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| djangoproject | django | {"endIncluding":"1.4.20"} | |
| djangoproject | django | 1.5 | |
| djangoproject | django | 1.5.1 | |
| djangoproject | django | 1.5.2 | |
| djangoproject | django | 1.5.3 | |
| djangoproject | django | 1.5.4 | |
| djangoproject | django | 1.5.5 | |
| djangoproject | django | 1.5.6 | |
| djangoproject | django | 1.5.7 | |
| djangoproject | django | 1.5.8 | |
| djangoproject | django | 1.5.9 | |
| djangoproject | django | 1.5.10 | |
| djangoproject | django | 1.5.11 | |
| djangoproject | django | 1.5.12 | |
| djangoproject | django | 1.6 | |
| djangoproject | django | 1.6.1 | |
| djangoproject | django | 1.6.2 | |
| djangoproject | django | 1.6.3 | |
| djangoproject | django | 1.6.4 | |
| djangoproject | django | 1.6.5 | |
| djangoproject | django | 1.6.6 | |
| djangoproject | django | 1.6.7 | |
| djangoproject | django | 1.6.8 | |
| djangoproject | django | 1.6.9 | |
| djangoproject | django | 1.6.10 | |
| djangoproject | django | 1.7 | |
| djangoproject | django | 1.7.1 | |
| djangoproject | django | 1.7.2 | |
| djangoproject | django | 1.7.3 | |
| djangoproject | django | 1.7.4 | |
| djangoproject | django | 1.7.5 | |
| djangoproject | django | 1.7.6 | |
| djangoproject | django | 1.7.7 | |
| djangoproject | django | 1.7.8 | |
| djangoproject | django | 1.7.9 | |
| djangoproject | django | 1.8 | |
| djangoproject | django | 1.8.0 | |
| djangoproject | django | 1.8.1 | |
| djangoproject | django | 1.8.2 | |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00043.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00046.html
- http://www.debian.org/security/2015/dsa-3305
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75665
- http://www.securitytracker.com/id/1032820
- http://www.ubuntu.com/usn/USN-2671-1
- https://security.gentoo.org/glsa/201510-06
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2015-5144
- https://github.com/django/django/commit/1ba1cdce7d58e6740fe51955d945b56ae51d072a
- https://github.com/django/django/commit/574dd5e0b0fbb877ae5827b1603d298edc9bb2a0
- https://github.com/django/django/commit/8f9a4d3a2bc42f14bb437defd30c7315adbff22c
- https://github.com/django/django/commit/ae49b4d994656bc037513dcd064cb9ce5bb85649
- https://github.com/django/django
- https://github.com/django/django/blob/4555a823fd57e261e1b19c778429473256c8ea08/docs/releases/1.4.21.txt#L30-L54
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-10.yaml
- https://web.archive.org/web/20150924150801/http://www.securitytracker.com/id/1032820
- https://web.archive.org/web/20200228050526/http://www.securityfocus.com/bid/75665
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases
- https://security-tracker.debian.org/tracker/CVE-2015-5144
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.