GHSA-q7q2-qf2q-rw3w

Django Vulnerable to Cache Poisoning

Source: GitHub Advisory Database (reviewed) Critical CVE-2014-1418

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 1.4, < 1.4.13	1.4.13
PyPI	Django	>= 1.5, < 1.5.8	1.5.8
PyPI	Django	>= 1.6, < 1.6.5	1.6.5
PyPI	Django	>= 1.7a1, < 1.7b4	1.7b4

Details

As written in the advisory (Markdown source, shown as plain text).

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-1418 advisory
https://github.com/django/django/commit/1abcf3a808b35abae5d425ed4d44cb6e886dc769 web
https://github.com/django/django/commit/28e23306aa53bbbb8fb87db85f99d970b051026c web
https://github.com/django/django/commit/4001ec8698f577b973c5a540801d8a0bbea1205b web
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-19.yaml web
https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued web
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html web
http://ubuntu.com/usn/usn-2212-1 web
http://www.debian.org/security/2014/dsa-2934 web
http://www.openwall.com/lists/oss-security/2014/05/14/10 web
http://www.openwall.com/lists/oss-security/2014/05/15/3 web