Description
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.7.9-1 | — |
| Debian 13 | python-django | 1.7.9-1 | — |
| Debian 12 | python-django | 1.7.9-1 | — |
| Debian 8 | python-django | 1.7.7-1+deb8u1 | DSA-3305-1 |
| Debian 7 | python-django | 1.4.5-1+deb7u12 | DSA-3305-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | python-django | 1.2.3-3+squeeze13 | DLA-272-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.9 | USN-2671-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | python-Django | 1.6.11-10.2 | SUSE-SU-2015:1810-1 |
| SUSE Enterprise Storage 2 | python-Django | 1.6.11-3.1 | SUSE-SU-2016:0044-1 |
| SUSE Enterprise Storage 1.0 | python-Django | 1.6.11-8.1 | SUSE-SU-2015:1815-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.4.21 | 1.4.21 | GHSA-q5qw-4364-5hhm |
| PyPI | django | >= 1.5, < 1.7.9 | 1.7.9 | GHSA-q5qw-4364-5hhm |
| PyPI | django | >= 1.8a1, < 1.8.3 | 1.8.3 | GHSA-q5qw-4364-5hhm |
| PyPI | django | < 1.4.21 · >= 1.5, < 1.7.9 · >= 1.8, < 1.8.3 | 1.4.21, 1.7.9, 1.8.3 | PYSEC-2015-10 |
Advisories 6
- DLA-272-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3305-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2671-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:0044-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1815-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1810-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2015-1dd5bc998f vendor-advisory
- GLSA-201510-06 vendor-advisory
- https://www.djangoproject.com/weblog/2015/jul/08/security-releases/
- openSUSE-SU-2015:1802 vendor-advisory
- openSUSE-SU-2015:1813 vendor-advisory
- DSA-3305 vendor-advisory
- 75665 vdb-entry
- USN-2671-1 vendor-advisory
- 1032820 vdb-entry
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html