SB2014051607 - Fedora EPEL 6 update for Django14

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014051607

SB2014051607 - Fedora EPEL 6 update for Django14

Published: May 16, 2014 Updated: April 24, 2025

Security Bulletin ID SB2014051607
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2014-1418)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.


2) Input validation error (CVE-ID: CVE-2014-3730)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\djangoproject.com."


Remediation

Install update from vendor's website.

References