VDB
PYSEC-2014-4
PYSEC-2014-4
PUBLISHED
Record from OSV · Published August 26, 2014
django is fixed in 1.6.6, 1.5.9 and 1.4.14 (PyPI)
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| django | PyPI | 1.6.6, 1.5.9, 1.4.14 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | django | 1.5, 1.0.1, 1.0.2 |
Timeline
- Aug 26, 2014 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2014-4
vulnetix vdb fixes PYSEC-2014-4Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2014-4/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://www.djangoproject.com/weblog/2014/aug/20/security/ article
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html url
- http://secunia.com/advisories/61281 advisory
- http://secunia.com/advisories/61276 advisory
- http://www.debian.org/security/2014/dsa-3010 advisory
- http://secunia.com/advisories/59782 advisory
- http://www.securityfocus.com/bid/69425 url