-
Notifications
You must be signed in to change notification settings - Fork 0
/
USN-2169-1.json
61 lines (61 loc) · 1.99 KB
/
USN-2169-1.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
{
"id": "USN-2169-1",
"summary": "python-django vulnerabilities",
"details": "Benjamin Bach discovered that Django incorrectly handled dotted Python\npaths when using the reverse() function. An attacker could use this issue\nto cause Django to import arbitrary modules from the Python path, resulting\nin possible code execution. (CVE-2014-0472)\n\nPaul McMillan discovered that Django incorrectly cached certain pages that\ncontained CSRF cookies. An attacker could possibly use this flaw to obtain\na valid cookie and perform attacks which bypass the CSRF restrictions.\n(CVE-2014-0473)\n\nMichael Koziarski discovered that Django did not always perform explicit\nconversion of certain fields when using a MySQL database. An attacker\ncould possibly use this issue to obtain unexpected results. (CVE-2014-0474)\n",
"aliases": [],
"related": [
"CVE-2014-0472",
"CVE-2014-0473",
"CVE-2014-0474"
],
"published": "2014-04-22T11:58:31.107433Z",
"modified": "2014-04-22T11:58:31.107433Z",
"affected": [
{
"package": {
"ecosystem": "Ubuntu:14.04:LTS",
"name": "python-django"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-2ubuntu0.1"
}
]
}
],
"ecosystem_specific": {
"binaries": [
{
"python-django-doc": "1.6.1-2ubuntu0.1",
"python-django": "1.6.1-2ubuntu0.1"
}
],
"availability": "No subscription needed"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-2169-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2014-0472"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2014-0473"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2014-0474"
}
]
}