Vulnerability advisory

PYSEC-2014-19

Published May 16, 2014Updated Jun 10, 2026OSV record ↗

Also known as CVE-2014-1418GHSA-q7q2-qf2q-rw3w

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`1.4` to before 1.4.13	`1.4.13`Advisories →
`1.5` to before 1.5.8	`1.5.8`Advisories →
`1.6` to before 1.6.5	`1.6.5`Advisories →
`1.7a0` to before 1.7b4	`1.7b4`Advisories →
Also listed as affected (26) `1.4` `1.4.1` `1.4.10` `1.4.11` `1.4.12` `1.4.2` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.4.9` `1.5` `1.5.1` `1.5.2` `1.5.3` `1.5.4` `1.5.5` `1.5.6` `1.5.7` `1.6` `1.6.1` `1.6.2` `1.6.3` `1.6.4`

Description

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.

References

Webwww.openwall.com/lists/oss-security/2014/05/15/3 ↗
Webubuntu.com/usn/usn-2212-1 ↗
ARTICLEwww.djangoproject.com/weblog/2014/may/14/security-releases-issued/ ↗
Webwww.openwall.com/lists/oss-security/2014/05/14/10 ↗
Advisorywww.debian.org/security/2014/dsa-2934 ↗
Weblists.opensuse.org/opensuse-updates/2014-09/msg00023.html ↗
Advisorysecunia.com/advisories/61281 ↗
Advisorygithub.com/advisories/GHSA-q7q2-qf2q-rw3w ↗