Inquiry Regarding CVE-2024-25170

[brawlingthebits]

Hello Mezzanine Team,

I hope you all are good!

I am writing to inquire about CVE-2024-25170, which has been reported for the Mezzanine project. However, I couldn't locate any updates or actions related to this vulnerability in the project repository or changelog. Could you please let me know if there are plans to address this vulnerability?

Thank you for your hard work and dedication to maintaining the Mezzanine project!

Best regards,
Costa

---

References:

1. [CVE-2024-25170](https://www.cve.org/CVERecord?id=CVE-2024-25170)
2. [Researcher's GH]
3. [Additional Information 1](https://imgbb.com/DpxHpz9)
4. [Additional Information 2](https://imgbb.com/T0fhLwR)

[niol]

ALLOWED_HOSTS is a Django setting. This looks like CVE-2016-9014.
In my view, the CVE record lacks some details to understand really what this is about.
If I try the following on my setup, I get an empty answer (Debug being False).
curl -sv --http1.1 --header 'Host: 127.0.0.1' https://mezzanine.example.net/