CVE-2015-0219

Description

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.

How to fix CVE-2015-0219

To remediate CVE-2015-0219, upgrade the affected package to a fixed version below.

• Debian/python-django—upgrade to 1.7.1-1.1 or later
• —upgrade to 1.2.3-3+squeeze12 or later
• —upgrade to 1.4.5-1+deb7u9 or later
• —upgrade to 1.4.18 or later
• —upgrade to 1.4.18 or later

Is CVE-2015-0219 being exploited?

Low — EPSS is 4.8%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 1.7.1-1.1
• from 0, < 1.2.3-3+squeeze12
• from 0, < 1.4.5-1+deb7u9
• from 0, < 1.4.18
• from 0, < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3

CVSS scores

References (28)

• ADVISORYsecunia.com/advisories/62285
• ADVISORYsecunia.com/advisories/62309
• ADVISORYsecunia.com/advisories/62718
• ADVISORYgithub.com/advisories/GHSA-7qfw-j7hp-v45g
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2015-0219