PT-2014-3650 · Django Software Foundation+1 · Django+1

David Greisen · Publicado 2014-08-26 · Atualizado 2022-05-14 · CVE-2014-0482

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.13 Django versions 1.5.x through 1.5.8 Django versions 1.6.x through 1.6.5 Django versions 1.7 before release candidate 3

Description The issue allows remote authenticated users to hijack web sessions via vectors related to the REMOTE USER header when using the contrib.auth.backends.RemoteUserBackend backend with the contrib.auth.middleware.RemoteUserMiddleware middleware.

Recommendations For Django versions 1.4.x through 1.4.13, update to version 1.4.14 or later. For Django versions 1.5.x through 1.5.8, update to version 1.5.9 or later. For Django versions 1.6.x through 1.6.5, update to version 1.6.6 or later. For Django versions 1.7 before release candidate 3, update to release candidate 3 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-0482

DLA-65-1

DSA-3010-1

GHSA-625G-GX8C-XCMG

MGASA-2014-0366

PYSEC-2014-6

SUSE-SU-2015:0563-1

SUSE-SU-2015:0695-1

USN-2347-1

Produtos afetados

Django

Ubuntu

Referências · 30

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/dd68f319b365f6cb38c5a6c106faf4f6142d7d88 · Nota
• https://github.com/django/django/commit/c9e3b9949cd55f090591fbdc4a114fcb8368b6d9 · Nota
• https://github.com/django/django/blob/aa3cb3f37265be37d892e2b391ff023e9caee2a4/docs/releases/1.5.9.txt#L42 · Nota
• https://github.com/django/django/commit/5307ce565fbedb9cc27cbe7c757b41a00438d37c · Nota
• https://github.com/django/django/commit/0268b855f9eab3377f2821164ef3e66037789e09 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-6.yaml · Nota
• https://osv.dev/vulnerability/USN-2347-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=13963 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0482 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://djangoproject.com/weblog/2014/aug/20/security · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0366 · Aviso do Fabricante
• http://secunia.com/advisories/61276 · Nota
• https://ubuntu.com/security/CVE-2014-0481 · Aviso do Fabricante