Spoofing In django
Description
Django WSGI Header Spoofing Vulnerability
Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 pypi | 1.4.18, 1.6.10, 1.7.3 | ||
 debian 12 | 1.7.1-1.1 | ||
debian 13 | 1.7.1-1.1 | ||
debian 14 | 1.7.1-1.1 | ||
debian 11 | 1.7.1-1.1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15.