CVE-2014-1418: High severity djangoproject Django vulnerability

Q: What is the severity of CVE-2014-1418?

CVE-2014-1418 is classified as a medium severity vulnerability due to its potential to expose sensitive information.

Q: How do I fix CVE-2014-1418?

To fix CVE-2014-1418, you should upgrade Django to version 1.4.13, 1.5.8, 1.6.5, or 1.7b4 or later.

Q: What products are affected by CVE-2014-1418?

CVE-2014-1418 affects Django versions prior to 1.4.13, 1.5.8, 1.6.5, and 1.7b4.

Q: What type of attacks can exploit CVE-2014-1418?

CVE-2014-1418 can be exploited by attackers to obtain sensitive information or poison the cache.

Q: Is there a workaround for CVE-2014-1418?

There is no documented workaround for CVE-2014-1418; updating to the patched versions is recommended.

Published May 16, 2014

Updated

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.

Affected Software

43 affected componentsFixes available

pip/Django>=1.7a1<1.7b4

1.7b4

pip/Django>=1.6<1.6.5

1.6.5

pip/Django>=1.5<1.5.8

1.5.8

pip/Django>=1.4<1.4.13

1.4.13

djangoproject Django=1.7-beta1

djangoproject Django=1.7-beta2

djangoproject Django=1.7-beta3

djangoproject Django=1.4

djangoproject Django=1.4.1

djangoproject Django=1.4.2

djangoproject Django=1.4.4

djangoproject Django=1.4.5

djangoproject Django=1.4.6

djangoproject Django=1.4.7

djangoproject Django=1.4.8

djangoproject Django=1.4.9

djangoproject Django=1.4.10

djangoproject Django=1.4.11

djangoproject Django=1.4.12

djangoproject Django=1.5

djangoproject Django=1.5-alpha

djangoproject Django=1.5-beta

djangoproject Django=1.5.1

djangoproject Django=1.5.2

djangoproject Django=1.5.3

djangoproject Django=1.5.4

djangoproject Django=1.5.5

djangoproject Django=1.5.6

djangoproject Django=1.5.7

Canonical Ubuntu Linux=10.04

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=12.10

Canonical Ubuntu Linux=13.10

Canonical Ubuntu Linux=14.04

djangoproject Django=1.6

djangoproject Django=1.6-beta1

djangoproject Django=1.6-beta2

djangoproject Django=1.6-beta3

djangoproject Django=1.6-beta4

djangoproject Django=1.6.1

djangoproject Django=1.6.2

djangoproject Django=1.6.3

djangoproject Django=1.6.4

Remediation

Patch Available

https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/

Event History

May 16, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:55 PM

RemedyDescriptionSeverityAffected Software

May 17, 2022

Advisory Published

via GitHub·03:07 AM

Frequently Asked Questions

What is the severity of CVE-2014-1418?

CVE-2014-1418 is classified as a medium severity vulnerability due to its potential to expose sensitive information.

How do I fix CVE-2014-1418?