Launchpad CVE tracker

CVE 2012-4520

The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.

Related bugs and status

CVE-2012-4520 (Candidate) is related to these bugs:

Bug #1068486: Please backport Django 1.3.4/1.4.2 security updates

		In	Importance	Status
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu)	Undecided	Fix Released
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu Lucid)	Undecided	Fix Released
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu Oneiric)	Undecided	Fix Released
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu Quantal)	Undecided	Fix Released
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu Precise)	Undecided	Fix Released
1068486	Please backport Django 1.3.4/1.4.2 security updates	python-django (Ubuntu Raring)	Undecided	Fix Released

Bug #1080204: Regression in security upload - self-tests fail if MANAGERS is defined in settings.py

		In	Importance	Status
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu Lucid)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu Oneiric)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu Precise)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu Quantal)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Ubuntu Raring)	Undecided	Fix Released
1080204	Regression in security upload - self-tests fail if MANAGERS is defined in settings.py	python-django (Debian)	Unknown	Fix Released

Bug #1372124: The Django version that the LTP uses is unsupported now

Summary				In	Importance	Status
	1372124	The Django version that the LTP uses is unsupported now		LoCo Team Portal	Critical	Triaged

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2012-4520

References