diff options
| author | Natalia <124304+nessita@users.noreply.github.com> | 2025-05-20 15:29:52 -0300 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-06-04 08:46:07 -0300 |
| commit | 596542ddb46cdabe011322917e1655f0d24eece2 (patch) | |
| tree | 0cd0aefe860ec27633ccb2fa8fd98732b2b0ad63 /django/__init__.py | |
| parent | a70841bc03a5f025c0c7d7a436021f154aee7bef (diff) | |
[5.1.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.
Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.
To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.
Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.
Co-authored-by: Carlton Gibson <carlton@noumenal.es>
Co-authored-by: Jake Howard <git@theorangeone.net>
Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.
Diffstat (limited to 'django/__init__.py')
0 files changed, 0 insertions, 0 deletions