ISOMAN

CVE

CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.

Severity
MEDIUM
CVSS
6.4
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
  2. http://secunia.com/advisories/61281
  3. http://ubuntu.com/usn/usn-2212-1
  4. http://www.debian.org/security/2014/dsa-2934
  5. http://www.openwall.com/lists/oss-security/2014/05/14/10
  6. http://www.openwall.com/lists/oss-security/2014/05/15/3
  7. https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/
  8. http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html
  9. http://secunia.com/advisories/61281
  10. http://ubuntu.com/usn/usn-2212-1
  11. http://www.debian.org/security/2014/dsa-2934
  12. http://www.openwall.com/lists/oss-security/2014/05/14/10
  13. http://www.openwall.com/lists/oss-security/2014/05/15/3
  14. https://www.djangoproject.com/weblog/2014/may/14/security-releases-issued/