CVE-2015-5144: Input Validation

Q: What is the severity of CVE-2015-5144?

CVE-2015-5144 has been classified as a moderate severity vulnerability.

Q: How do I fix CVE-2015-5144?

To fix CVE-2015-5144, upgrade Django to version 1.8.3 or above, 1.7.9 or above, or 1.4.21.

Q: What types of attacks are possible due to CVE-2015-5144?

CVE-2015-5144 allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks.

Q: Which versions of Django are affected by CVE-2015-5144?

Django versions before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 are affected.

Q: Is there a workaround for CVE-2015-5144 if I cannot upgrade Django?

No specific workaround is available for CVE-2015-5144; upgrading to a patched version is recommended.

Published Jul 14, 2015

Updated

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validateipv4address or (4) validateslug validator.

Affected Software

61 affected componentsFixes available

pip/Django>=1.8a1<1.8.3

1.8.3

pip/Django>=1.5<1.7.9

1.7.9

pip/django<1.4.21

1.4.21

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=15.04

Canonical Ubuntu Linux=15.10

djangoproject Django<=1.4.20

djangoproject Django=1.5

djangoproject Django=1.5-alpha

djangoproject Django=1.5-beta

djangoproject Django=1.5.1

djangoproject Django=1.5.2

djangoproject Django=1.5.3

djangoproject Django=1.5.4

djangoproject Django=1.5.5

djangoproject Django=1.5.6

djangoproject Django=1.5.7

djangoproject Django=1.5.8

djangoproject Django=1.5.9

djangoproject Django=1.5.10

djangoproject Django=1.5.11

djangoproject Django=1.5.12

djangoproject Django=1.6

djangoproject Django=1.6-beta1

djangoproject Django=1.6-beta2

djangoproject Django=1.6-beta3

djangoproject Django=1.6-beta4

djangoproject Django=1.6.1

djangoproject Django=1.6.2

djangoproject Django=1.6.3

djangoproject Django=1.6.4

djangoproject Django=1.6.5

djangoproject Django=1.6.6

djangoproject Django=1.6.7

djangoproject Django=1.6.8

djangoproject Django=1.6.9

djangoproject Django=1.6.10

djangoproject Django=1.7-beta1

djangoproject Django=1.7-beta2

djangoproject Django=1.7-beta3

djangoproject Django=1.7-beta4

djangoproject Django=1.7-rc1

djangoproject Django=1.7-rc2

djangoproject Django=1.7-rc3

djangoproject Django=1.7.1

djangoproject Django=1.7.2

djangoproject Django=1.7.3

djangoproject Django=1.7.4

djangoproject Django=1.7.5

djangoproject Django=1.7.6

djangoproject Django=1.7.7

djangoproject Django=1.7.8

djangoproject Django=1.7.9

djangoproject Django=1.8-beta1

djangoproject Django=1.8.0

djangoproject Django=1.8.1

djangoproject Django=1.8.2

Debian Debian Linux=7.0

Debian Debian Linux=8.0

Oracle Solaris=11.3

Event History

Jul 14, 2015

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

May 17, 2022

Advisory Published

via GitHub·12:48 AM

Frequently Asked Questions

What is the severity of CVE-2015-5144?

CVE-2015-5144 has been classified as a moderate severity vulnerability.

How do I fix CVE-2015-5144?

To fix CVE-2015-5144, upgrade Django to version 1.8.3 or above, 1.7.9 or above, or 1.4.21.

What types of attacks are possible due to CVE-2015-5144?