CVE-2015-5144
Summary
| CVE | CVE-2015-5144 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-07-14 17:59:07 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.10 | All | All | All |
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Djangoproject | Django | 1.5 | All | All | All |
| Application | Djangoproject | Django | 1.5 | alpha | All | All |
| Application | Djangoproject | Django | 1.5 | beta | All | All |
| Application | Djangoproject | Django | 1.5.1 | All | All | All |
| Application | Djangoproject | Django | 1.5.10 | All | All | All |
| Application | Djangoproject | Django | 1.5.11 | All | All | All |
| Application | Djangoproject | Django | 1.5.12 | All | All | All |
| Application | Djangoproject | Django | 1.5.2 | All | All | All |
| Application | Djangoproject | Django | 1.5.3 | All | All | All |
| Application | Djangoproject | Django | 1.5.4 | All | All | All |
| Application | Djangoproject | Django | 1.5.5 | All | All | All |
| Application | Djangoproject | Django | 1.5.6 | All | All | All |
| Application | Djangoproject | Django | 1.5.7 | All | All | All |
| Application | Djangoproject | Django | 1.5.8 | All | All | All |
| Application | Djangoproject | Django | 1.5.9 | All | All | All |
| Application | Djangoproject | Django | 1.6 | - | All | All |
| Application | Djangoproject | Django | 1.6 | beta1 | All | All |
| Application | Djangoproject | Django | 1.6 | beta2 | All | All |
| Application | Djangoproject | Django | 1.6 | beta3 | All | All |
| Application | Djangoproject | Django | 1.6 | beta4 | All | All |
| Application | Djangoproject | Django | 1.6.1 | All | All | All |
| Application | Djangoproject | Django | 1.6.10 | All | All | All |
| Application | Djangoproject | Django | 1.6.2 | All | All | All |
| Application | Djangoproject | Django | 1.6.3 | All | All | All |
| Application | Djangoproject | Django | 1.6.4 | All | All | All |
| Application | Djangoproject | Django | 1.6.5 | All | All | All |
| Application | Djangoproject | Django | 1.6.6 | All | All | All |
| Application | Djangoproject | Django | 1.6.7 | All | All | All |
| Application | Djangoproject | Django | 1.6.8 | All | All | All |
| Application | Djangoproject | Django | 1.6.9 | All | All | All |
| Application | Djangoproject | Django | 1.7 | beta1 | All | All |
| Application | Djangoproject | Django | 1.7 | beta2 | All | All |
| Application | Djangoproject | Django | 1.7 | beta3 | All | All |
| Application | Djangoproject | Django | 1.7 | beta4 | All | All |
| Application | Djangoproject | Django | 1.7 | rc1 | All | All |
| Application | Djangoproject | Django | 1.7 | rc2 | All | All |
| Application | Djangoproject | Django | 1.7 | rc3 | All | All |
| Application | Djangoproject | Django | 1.7.1 | All | All | All |
| Application | Djangoproject | Django | 1.7.2 | All | All | All |
| Application | Djangoproject | Django | 1.7.3 | All | All | All |
| Application | Djangoproject | Django | 1.7.4 | All | All | All |
| Application | Djangoproject | Django | 1.7.5 | All | All | All |
| Application | Djangoproject | Django | 1.7.6 | All | All | All |
| Application | Djangoproject | Django | 1.7.7 | All | All | All |
| Application | Djangoproject | Django | 1.7.8 | All | All | All |
| Application | Djangoproject | Django | 1.7.9 | All | All | All |
| Application | Djangoproject | Django | 1.8 | beta1 | All | All |
| Application | Djangoproject | Django | 1.8.0 | All | All | All |
| Application | Djangoproject | Django | 1.8.1 | All | All | All |
| Application | Djangoproject | Django | 1.8.2 | All | All | All |
| Application | Djangoproject | Django | All | All | All | All |
| Operating System | Oracle | Solaris | 11.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| openSUSE-SU-2015:1813-1: moderate: Security update for python-Django | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Django Bugs Let Remote Users Deny Service and Conduct HTTP/Header Response Splitting Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Security releases issued: 1.8.3, 1.7.9, 1.4.21 | Weblog | Django | af854a3a-2127-422b-91ae-364da2661108 | www.djangoproject.com | Vendor Advisory |
| openSUSE-SU-2015:1802-1: moderate: Security update for python-django | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Django CVE-2015-5144 Header Injection Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 23 Update: python-django-1.8.6-1.fc23 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Django: Multiple vulnerabilities (GLSA 201510-06) — Gentoo Security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Oracle Solaris Third Party Bulletin - October 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| Debian -- Security Information -- DSA-3305-1 python-django | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| USN-2671-1: Django vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.