{"id":"CVE-2015-0219","aliases":["DEBIAN-CVE-2015-0219","DLA-143-1","DSA-3151-1","EUVD-2015-0013","GHSA-7qfw-j7hp-v45g","MGASA-2015-0026","PYSEC-2015-4","SUSE-SU-2015:0563-1","SUSE-SU-2015:0695-1","SUSE-SU-2015:1109-1","SUSE-SU-2015:1112-1","UBUNTU-CVE-2015-0219","USN-2469-1","openSUSE-SU-2024:10206-1","openSUSE-SU-2024:11218-1","openSUSE-SU-2024:14133-1","openSUSE-SU-2026:12000-1"],"status":"published","title":"Django WSGI Header Spoofing Vulnerability","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.06969,"percentile":0.94182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-17","CWE-290"],"published":"2014-09-03T15:51:02Z","modified":"2026-10-05T10:26:49Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.4.18","1.6.10","1.7.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["1.7.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["1.7.1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["1.7.1-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"python-django","fixed_in":["1.6.1-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-bjoern","fixed_in":["1.4.2-1.23","3.2.2-1.10","3.2.2-2.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-3+squeeze12"}]}],"versions":["1.2.3-3","1.2.3-3+squeeze1","1.2.3-3+squeeze10","1.2.3-3+squeeze11","1.2.3-3+squeeze2","1.2.3-3+squeeze3","1.2.3-3+squeeze5","1.2.3-3+squeeze6","1.2.3-3+squeeze7","1.2.3-3+squeeze8","1.2.3-3+squeeze9"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1+deb7u9"}]}],"versions":["1.4.5-1","1.4.5-1+deb7u1","1.4.5-1+deb7u2","1.4.5-1+deb7u3","1.4.5-1+deb7u4","1.4.5-1+deb7u4~bpo60+1","1.4.5-1+deb7u5","1.4.5-1+deb7u6","1.4.5-1+deb7u7","1.4.5-1+deb7u7~bpo60+1","1.4.5-1+deb7u8","1.4.5-1+deb7u8~bpo60+1"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6.10"}]}],"versions":["1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7.3"}]}],"versions":["1.7","1.7.1","1.7.2"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-django14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18-1.1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-1.1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.18"},{"introduced":"1.5"},{"fixed":"1.6.10"},{"introduced":"1.7"},{"fixed":"1.7.3"}]}],"versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.2","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.4","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5","1.5.1","1.5.10","1.5.11","1.5.12","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7","1.7.1","1.7.2"]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 1.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.6"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.6"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bjoern","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1.23"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bjoern","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1.10"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-bjoern","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2.6"}]}]}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"http://secunia.com/advisories/62718","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148608.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:036","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148696.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/62285","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-09/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.djangoproject.com/weblog/2015/jan/13/security/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Vendor Advisory","advisory","evidence","fix","web","article","report"]},{"url":"http://www.ubuntu.com/usn/USN-2469-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-04/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/62309","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:109","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2015-0026.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148485.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0219","tags":["advisory"]},{"url":"https://github.com/django/django/commit/41b4bc73ee0da7b2e09f4af47fc1fd21144c710f","tags":["web"]},{"url":"https://github.com/django/django/commit/4f6fffc1dc429f1ad428ecf8e6620739e8837450","tags":["web"]},{"url":"https://github.com/django/django/commit/d7597b31d5c03106eeba4be14a33b32a5e25f4ee","tags":["web"]},{"url":"https://github.com/django/daphne/blob/e49c39a4e5fac8ec170dd653641a9e90844fd3f1/daphne/http_protocol.py#L151","tags":["web"]},{"url":"https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62285","tags":["web"]},{"url":"https://web.archive.org/web/20150128111656/http://secunia.com/advisories/62309","tags":["web"]},{"url":"https://web.archive.org/web/20150523054951/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:109/?name=MDVSA-2015:109","tags":["web"]},{"url":"https://web.archive.org/web/20150523054953/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:036/?name=MDVSA-2015:036","tags":["web"]},{"url":"https://web.archive.org/web/20151104201446/http://secunia.com/advisories/62718","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-4.yaml","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2015/jan/13/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7qfw-j7hp-v45g","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0219","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0026.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15045","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2469-1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150563-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/893087","tags":["report"]},{"url":"https://bugzilla.suse.com/893088","tags":["report"]},{"url":"https://bugzilla.suse.com/893089","tags":["report"]},{"url":"https://bugzilla.suse.com/893090","tags":["report"]},{"url":"https://bugzilla.suse.com/913053","tags":["report"]},{"url":"https://bugzilla.suse.com/913054","tags":["report"]},{"url":"https://bugzilla.suse.com/913055","tags":["report"]},{"url":"https://bugzilla.suse.com/913056","tags":["report"]},{"url":"https://bugzilla.suse.com/914706","tags":["report"]},{"url":"https://bugzilla.suse.com/923176","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0220","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2317","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150695-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151109-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/923172","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151112-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-0219","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2469-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0220","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0222","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-0219","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:00:00Z","modified":"2024-08-06T04:03:10.188Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2015-0013","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:00:00Z","modified":"2024-08-06T04:03:10Z","updated_at":"2026-11-03T02:22:20.910497Z"}],"ghsa":[{"id":"GHSA-7qfw-j7hp-v45g","title":"Django WSGI Header Spoofing Vulnerability","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X-Auth_User` header.","status":"published","published":"2022-05-17T03:20:54Z","modified":"2024-09-18T14:42:14Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:38:03.800952Z"}],"nvd":[{"id":"CVE-2015-0219","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:59:18.657Z","modified":"2026-06-17T00:19:45.16Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-17"],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"GHSA-7qfw-j7hp-v45g","title":"Django WSGI Header Spoofing Vulnerability","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X-Auth_User` header.","status":"published","published":"2022-05-17T03:20:54Z","modified":"2024-09-18T14:59:09.78876Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"CVE-2015-0219","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:59:18Z","modified":"2026-10-05T10:26:49.161339937Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0219","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:59:18.657Z","modified":"2026-09-09T06:47:26.655553162Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-143-1","title":"python-django - security update","status":"published","published":"2015-01-29T00:00:00Z","modified":"2026-03-09T01:02:01.144311Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3151-1","title":"python-django - security update","status":"published","published":"2015-02-03T00:00:00Z","modified":"2026-03-09T01:22:42.912597Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0026","title":"Updated python-django and python-django14 packages fix security vulnerabilities","description":"Jedediah Smith discovered that Django incorrectly handled underscores in\nWSGI headers. A remote attacker could possibly use this issue to spoof\nheaders in certain environments (CVE-2015-0219).\n\nMikko Ohtamaa discovered that Django incorrectly handled user-supplied\nredirect URLs. A remote attacker could possibly use this issue to perform a\ncross-site scripting attack (CVE-2015-0220).\n\nAlex Gaynor discovered that Django incorrectly handled reading files in\ndjango.views.static.serve(). A remote attacker could possibly use this\nissue to cause Django to consume resources, resulting in a denial of\nservice (CVE-2015-0221).\n\nKeryn Knight discovered that Django incorrectly handled forms with\nModelMultipleChoiceField. A remote attacker could possibly use this issue\nto cause a large number of SQL queries, resulting in a database denial of\nservice. Note that this issue only affected python-django (CVE-2015-0222).\n","status":"published","published":"2015-01-17T22:31:08Z","modified":"2026-04-16T06:25:31.62344353Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10206-1","title":"python-bjoern-1.4.2-1.23 on GA media","description":"These are all security issues fixed in the python-bjoern-1.4.2-1.23 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:21.022096Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11218-1","title":"python36-bjoern-3.1.0-1.8 on GA media","description":"These are all security issues fixed in the python36-bjoern-3.1.0-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:23.224077Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14133-1","title":"python310-bjoern-3.2.2-1.10 on GA media","description":"These are all security issues fixed in the python310-bjoern-3.2.2-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:09:14.546908Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:12000-1","title":"python313-bjoern-3.2.2-2.6 on GA media","description":"These are all security issues fixed in the python313-bjoern-3.2.2-2.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:55.501095463Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2015-4","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-16T16:59:00Z","modified":"2026-06-10T17:01:01.20836883Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2015:0563-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:24:37.285672Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0695-1","title":"Security update for python-django","description":"\npython-django was updated to 1.5.10 fixing bugs and security issues:\n\n    * Prevented reverse() from generating URLs pointing to other hosts to\n      prevent phishing attacks. (bnc#893087, CVE-2014-0480)\n    * Removed O(n) algorithm when uploading duplicate file names to fix\n      file upload denial of service. (bnc#893088, CVE-2014-0481)\n    * Modified RemoteUserMiddleware to logout on REMOTE_USE change to\n      prevent session hijacking. (bnc#893089, CVE-2014-0482)\n    * Prevented data leakage in contrib.admin via query string\n      manipulation. (bnc#893090, CVE-2014-0483)\n\nSecurity Issues:\n\n    * CVE-2014-0480\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0480\u003e\n    * CVE-2014-0481\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0481\u003e\n    * CVE-2014-0482\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0482\u003e\n    * CVE-2014-0483\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0483\u003e\n\n","status":"published","published":"2014-09-03T15:51:02Z","modified":"2026-02-04T02:17:29.821596Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1109-1","title":"Security update for python-Django","description":"python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve``   (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n","status":"published","published":"2015-03-30T09:04:33Z","modified":"2026-02-04T03:52:43.807161Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1112-1","title":"Security update for python-Django","description":"python-django was updated to 1.6.11 to fix security issues and non-security bugs.\n\nThe following vulnerabilities were fixed:\n\n* Made is_safe_url() reject URLs that start with control characters to mitigate possible XSS attack via user-supplied redirect URLs (bnc#923176, CVE-2015-2317)\n* Fixed an infinite loop possibility in strip_tags() (bnc#923172, CVE-2015-2316)\n* WSGI header spoofing via underscore/dash conflation (bnc#913053, CVE-2015-0219)\n* Mitigated possible XSS attack via user-supplied redirect URLs\n* Denial-of-service attack against ``django.views.static.serve``   (bnc#913056, CVE-2015-0221)\n* Database denial-of-service with ``ModelMultipleChoiceField`` (bnc#913055, CVE-2015-0222)\n\nThe update also contains fixes for non-security bugs, functional and stability issues.\n","status":"published","published":"2015-03-30T09:04:33Z","modified":"2026-02-04T04:29:25.747143Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-0219","description":"Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.","status":"published","published":"2015-01-13T00:00:00Z","modified":"2026-02-04T03:59:55.975435Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2469-1","title":"python-django vulnerabilities","description":"Jedediah Smith discovered that Django incorrectly handled underscores in\nWSGI headers. A remote attacker could possibly use this issue to spoof\nheaders in certain environments. (CVE-2015-0219)\n\nMikko Ohtamaa discovered that Django incorrectly handled user-supplied\nredirect URLs. A remote attacker could possibly use this issue to perform a\ncross-site scripting attack. (CVE-2015-0220)\n\nAlex Gaynor discovered that Django incorrectly handled reading files in\ndjango.views.static.serve(). A remote attacker could possibly use this\nissue to cause Django to consume resources, resulting in a denial of\nservice. (CVE-2015-0221)\n\nKeryn Knight discovered that Django incorrectly handled forms with\nModelMultipleChoiceField. A remote attacker could possibly use this issue\nto cause a large number of SQL queries, resulting in a database denial of\nservice. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10.\n(CVE-2015-0222)\n","status":"published","published":"2015-01-13T19:40:45Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}