PT-2014-5471 · Django Software Foundation · Django

Gavin Wahl + 1 · Publicado 2014-05-15 · Atualizado 2022-05-14 · CVE-2014-3730

Positive Technologies (AI Summary)

CVSS v4.0

7.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Django versions 1.4 through 1.4.12 Django versions 1.5 through 1.5.7 Django versions 1.6 through 1.6.4 Django versions 1.7 through 1.7b3

Description The django.util.http.is safe url function does not properly validate URLs, allowing remote attackers to conduct open redirect attacks via a malformed URL.

Recommendations For Django versions 1.4 through 1.4.12, update to version 1.4.13 or later. For Django versions 1.5 through 1.5.7, update to version 1.5.8 or later. For Django versions 1.6 through 1.6.4, update to version 1.6.5 or later. For Django versions 1.7 through 1.7b3, update to version 1.7b4 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-3730

DSA-2934-1

GHSA-VQ3H-3Q7V-9PRW

MGASA-2014-0231

PYSEC-2014-20

USN-2212-1

Produtos afetados

Django

Referências · 29

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df · Nota
• https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d · Nota
• https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-20.yaml · Nota
• https://ubuntu.com/security/CVE-2014-1418 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-2212-1 · Aviso do Fabricante
• https://djangoproject.com/weblog/2014/may/14/security-releases-issued · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3730 · Aviso do Fabricante
• http://debian.org/security/2014/dsa-2934 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3730 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-3730 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-3730 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3730 · Nota de Segurança