Vulnerability advisory

PYSEC-2014-20

Published May 16, 2014Updated Jun 10, 2026OSV record ↗

Also known as CVE-2014-3730GHSA-vq3h-3q7v-9prw

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`1.4` to before 1.4.13	`1.4.13`Advisories →
`1.5` to before 1.5.8	`1.5.8`Advisories →
`1.6` to before 1.6.5	`1.6.5`Advisories →
`1.7a0` to before 1.7b4	`1.7b4`Advisories →
Also listed as affected (26) `1.4` `1.4.1` `1.4.10` `1.4.11` `1.4.12` `1.4.2` `1.4.3` `1.4.4` `1.4.5` `1.4.6` `1.4.7` `1.4.8` `1.4.9` `1.5` `1.5.1` `1.5.2` `1.5.3` `1.5.4` `1.5.5` `1.5.6` `1.5.7` `1.6` `1.6.1` `1.6.2` `1.6.3` `1.6.4`

Description

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."

References

Webubuntu.com/usn/usn-2212-1 ↗
ARTICLEwww.djangoproject.com/weblog/2014/may/14/security-releases-issued/ ↗
Webwww.openwall.com/lists/oss-security/2014/05/15/3 ↗
Webwww.openwall.com/lists/oss-security/2014/05/14/10 ↗
Advisorywww.debian.org/security/2014/dsa-2934 ↗
Weblists.opensuse.org/opensuse-updates/2014-09/msg00023.html ↗
Webwww.securityfocus.com/bid/67410 ↗
Advisorysecunia.com/advisories/61281 ↗
Advisorygithub.com/advisories/GHSA-vq3h-3q7v-9prw ↗