GHSA-vq3h-3q7v-9prw

Django Allows Open Redirects

Source: GitHub Advisory Database (reviewed) High CVE-2014-3730

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 1.4, < 1.4.13	1.4.13
PyPI	Django	>= 1.5, < 1.5.8	1.5.8
PyPI	Django	>= 1.6, < 1.6.5	1.6.5
PyPI	Django	>= 1.7a1, < 1.7b4	1.7b4

Details

As written in the advisory (Markdown source, shown as plain text).

The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-3730 advisory
https://github.com/django/django/commit/601107524523bca02376a0ddc1a06c6fdb8f22f3 web
https://github.com/django/django/commit/7feb54bbae3f637ab3c4dd4831d4385964f574df web
https://github.com/django/django/commit/ad32c218850ad40972dcef57beb460f8c979dd6d web
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-20.yaml web
https://web.archive.org/web/20200228171223/http://www.securityfocus.com/bid/67410 web
https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued web
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html web
http://secunia.com/advisories/61281 web
http://ubuntu.com/usn/usn-2212-1 web
http://www.debian.org/security/2014/dsa-2934 web
http://www.openwall.com/lists/oss-security/2014/05/14/10 web
http://www.openwall.com/lists/oss-security/2014/05/15/3 web