PT-2014-4178 · Django Software Foundation+1 · Django+1

James Westby + 3 · Publicado 2014-05-14 · Atualizado 2022-05-17 · CVE-2014-1418

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Django versions 1.4 through 1.4.12 Django versions 1.5 through 1.5.7 Django versions 1.6 through 1.6.4 Django versions 1.7 before 1.7b4

Description The issue allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers, due to the improper inclusion of the Vary: Cookie or Cache-Control header in responses.

Recommendations For Django versions 1.4 through 1.4.12, update to version 1.4.13 or later. For Django versions 1.5 through 1.5.7, update to version 1.5.8 or later. For Django versions 1.6 through 1.6.4, update to version 1.6.5 or later. For Django versions 1.7 before 1.7b4, update to version 1.7b4 or later.

Correção

Enumeração de Fraquezas

CWE-349

Identificadores relacionados

CVE-2014-1418

DSA-2934-1

GHSA-Q7Q2-QF2Q-RW3W

MGASA-2014-0231

PYSEC-2014-19

USN-2212-1

Produtos afetados

Django

Ubuntu

Referências · 28

• https://github.com/django/django · Nota
• https://github.com/django/django/blob/master/django/http/utils.py#L73 · Nota
• https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769 · Nota
• https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c · Nota
• https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-19.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1418 · Nota de Segurança
• https://djangoproject.com/weblog/2014/may/14/security-releases-issued · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0231.html · Nota de Segurança
• http://ubuntu.com/usn/usn-2212-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-1418 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/14/10 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2212-1 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2934 · Aviso do Fabricante