CVE-2014-1418 Django Vulnerable to Cache Poisoning
Remote attackers can obtain sensitive information or poison the cache due to missing Vary and Cache-Control headers in Django responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-1418?
CVE-2014-1418 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 16 May 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
Which versions are affected by CVE-2014-1418?
9 open source packages ship an affected version, including django and Django. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | From 1.4 | 1.4.13, 1.5.8, 1.6.5, 1.7b4 |
django PyPI | From 1.4 | 1.4.13 |
django PyPI | From 1.5 | 1.5.8 |
django PyPI | From 1.6 | 1.6.5 |
django PyPI | From 1.7a1 | 1.7b4 |
Django PyPI | From 1.4 | 1.4.13 |
3 more packages
Django PyPI | From 1.5 | 1.5.8 |
Django PyPI | From 1.6 | 1.6.5 |
Django PyPI | From 1.7a1 | 1.7b4 |
Products include Canonical Ubuntu Linux, Djangoproject Django.
How do I fix CVE-2014-1418?
Upgrade django to a fixed version for your release line: 1.4.13, 1.5.8, 1.6.5 or 1.7b4.
Is CVE-2014-1418 being exploited?
There is no known exploitation of CVE-2014-1418 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2014-1418, GHSA-q7q2-qf2q-rw3w, PYSEC-2014-19, UBUNTU-CVE-2014-1418, USN-2212-1.