—

PYSEC-2014-2

Quick fix

PYSEC-2014-2 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=1.4.11'

Details

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 0Fixed in: 1.4.11

Fixpip install --upgrade 'django>=1.4.11'

References

https://www.djangoproject.com/weblog/2014/apr/21/security/[ARTICLE]
http://www.ubuntu.com/usn/USN-2169-1[ADVISORY]
http://rhn.redhat.com/errata/RHSA-2014-0457.html[ADVISORY]
http://www.debian.org/security/2014/dsa-2934[ADVISORY]
http://rhn.redhat.com/errata/RHSA-2014-0456.html[ADVISORY]
http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html[WEB]
http://secunia.com/advisories/61281[ADVISORY]
https://github.com/advisories/GHSA-89hj-xfx5-7q66[ADVISORY]