Django 1.3.4 release notes

This is the fourth release in the Django 1.3 series.

Django’s own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 — specifically, — was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on “validsite.com”:

To remedy this, the parsing in is being modified; Host headers which contain potentially dangerous content (such as username/password pairs) now raise the exception .