~ / search / GHSA-89hj-xfx5-7q66

GHSA-89hj-xfx5-7q66

Django Reuses Cached CSRF Token

Source: GitHub Advisory Database (reviewed) High CVE-2014-0473

Packages

EcosystemPackageAffectedFixed in
PyPI Django < 1.4.11 1.4.11
PyPI Django >= 1.5, < 1.5.6 1.5.6
PyPI Django >= 1.6, < 1.6.3 1.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

References

External links from the advisory. They lead to third-party sites.