CVE-2007-0404: High severity Django Project Django vulnerability
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
Other sources
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0404?
CVE-2007-0404 is a critical vulnerability that allows for arbitrary command execution in Django 0.95.
How do I fix CVE-2007-0404?
To fix CVE-2007-0404, upgrade Django to version 1.0 or later.
Which versions of Django are affected by CVE-2007-0404?
CVE-2007-0404 affects Django version 0.95.
What is the impact of CVE-2007-0404 on my application?
CVE-2007-0404 could allow attackers to execute arbitrary commands on your server through malicious .po or .mo files.
Is CVE-2007-0404 still a threat in modern applications?
CVE-2007-0404 is a threat primarily to legacy systems still using Django 0.95, as it has been patched in later versions.