CVE-2015-5144
Last modified
CVE-2015-5144 is a vulnerability of currently unknown severity. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.. EPSS estimates a 3.68% chance of exploitation in the next 30 days.
Description
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Canonical | Ubuntu Linux | 12.04 | — |
| Canonical | Ubuntu Linux | 14.04 | — |
| Canonical | Ubuntu Linux | 15.04 | — |
| Canonical | Ubuntu Linux | 15.10 | — |
| Djangoproject | Django | <= 1.4.20 | — |
| Djangoproject | Django | 1.5 | — |
| Djangoproject | Django | 1.5.1 | — |
| Djangoproject | Django | 1.5.2 | — |
| Djangoproject | Django | 1.5.3 | — |
| Djangoproject | Django | 1.5.4 | — |
| Djangoproject | Django | 1.5.5 | — |
| Djangoproject | Django | 1.5.6 | — |
| Djangoproject | Django | 1.5.7 | — |
| Djangoproject | Django | 1.5.8 | — |
| Djangoproject | Django | 1.5.9 | — |
| Djangoproject | Django | 1.5.10 | — |
| Djangoproject | Django | 1.5.11 | — |
| Djangoproject | Django | 1.5.12 | — |
| Djangoproject | Django | 1.6 | — |
| Djangoproject | Django | 1.6.1 | — |
| Djangoproject | Django | 1.6.2 | — |
| Djangoproject | Django | 1.6.3 | — |
| Djangoproject | Django | 1.6.4 | — |
| Djangoproject | Django | 1.6.5 | — |
| Djangoproject | Django | 1.6.6 | — |
| Djangoproject | Django | 1.6.7 | — |
| Djangoproject | Django | 1.6.8 | — |
| Djangoproject | Django | 1.6.9 | — |
| Djangoproject | Django | 1.6.10 | — |
| Djangoproject | Django | 1.7 | Beta1 |
| Djangoproject | Django | 1.7.1 | — |
| Djangoproject | Django | 1.7.2 | — |
| Djangoproject | Django | 1.7.3 | — |
| Djangoproject | Django | 1.7.4 | — |
| Djangoproject | Django | 1.7.5 | — |
| Djangoproject | Django | 1.7.6 | — |
| Djangoproject | Django | 1.7.7 | — |
| Djangoproject | Django | 1.7.8 | — |
| Djangoproject | Django | 1.7.9 | — |
| Djangoproject | Django | 1.8 | Beta1 |
| Djangoproject | Django | 1.8.0 | — |
| Djangoproject | Django | 1.8.1 | — |
| Djangoproject | Django | 1.8.2 | — |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Oracle | Solaris | 11.3 | — |
References
- http://www.debian.org/security/2015/dsa-3305Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.ubuntu.com/usn/USN-2671-1Third Party Advisory
- http://www.debian.org/security/2015/dsa-3305Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.ubuntu.com/usn/USN-2671-1Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-5144?
How severe is CVE-2015-5144?
How do I fix CVE-2015-5144?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-5130Use-after-free vulnerability in Adobe Flash Player before 18…
- CVE-2015-5131Buffer overflow in Adobe Flash Player before 18.0.0.232 on W…
- CVE-2015-5132Buffer overflow in Adobe Flash Player before 18.0.0.232 on W…
- CVE-2015-5133Buffer overflow in Adobe Flash Player before 18.0.0.232 on W…
- CVE-2015-5134Use-after-free vulnerability in Adobe Flash Player before 18…
- CVE-2015-5143The session backends in Django before 1.4.21, 1.5.x through …
- CVE-2015-5145validators.URLValidator in Django 1.8.x before 1.8.3 allows …
- CVE-2015-5146ntpd in ntp before 4.2.8p3 with remote configuration enabled…
- CVE-2015-5147Stack-based buffer overflow in the header_anchor function in…
- CVE-2015-5148SQL injection vulnerability in LivelyCart 1.2.0 allows remot…
- CVE-2015-5149Directory traversal vulnerability in Zoho ManageEngine Suppo…
- CVE-2015-5150Multiple cross-site scripting (XSS) vulnerabilities in Zoho …
Are you affected by CVE-2015-5144?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST