REDHAT-BUG-2370365: Medium severity Django Django vulnerability
An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2370365?
The severity of REDHAT-BUG-2370365 is considered critical due to its potential to allow log injection or forgery.
How do I fix REDHAT-BUG-2370365?
To fix REDHAT-BUG-2370365, update Django to version 5.2.2 or later, 5.1.10 or later, or 4.2.22 or later.
Who is affected by REDHAT-BUG-2370365?
REDHAT-BUG-2370365 affects users running Django versions prior to 5.2.2, 5.1.10, and 4.2.22.
What consequences can arise from REDHAT-BUG-2370365?
Consequences of REDHAT-BUG-2370365 include potential manipulation of log output by remote attackers, leading to misleading log entries.
Is REDHAT-BUG-2370365 a type of logging vulnerability?
Yes, REDHAT-BUG-2370365 is classified as a logging vulnerability due to inadequate escaping of request.path.