Severity
Severity not reported.
Affected versions
No affected versions listed.
Description
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
References
- Advisorysecunia.com/advisories/61281 ↗
- Advisorywww.debian.org/security/2014/dsa-2934 ↗
- Advisorywww.djangoproject.com/weblog/2014/may/14/security-releases-issued/ ↗
- Fixwww.djangoproject.com/weblog/2014/may/14/security-releases-issued/ ↗
- Weblists.opensuse.org/opensuse-updates/2014-09/msg00023.html ↗
- Webubuntu.com/usn/usn-2212-1 ↗
- Webwww.openwall.com/lists/oss-security/2014/05/14/10 ↗
- Webwww.openwall.com/lists/oss-security/2014/05/15/3 ↗