Skip to content
OpenAdvisories
Critical RHSA-2014:0457 3 CVEs

Red Hat Security Advisory: Django security update

Published Sep 15, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 Django14 0:1.4.11-1.el6ost
Red Hat · OpenStack 3 openstack:3::el6 Django14-doc 0:1.4.11-1.el6ost

Vulnerabilities 3

  • Critical 9.8
    CVE-2014-0472 Public exploit

    Code Injection in Django

    The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…

    python-django django python-django Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2014-0474

    Django Vulnerable to MySQL Injection

    The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to…

    python-django django python-django Debian Ubuntu PyPI
  • High 7.5
    CVE-2014-0473

    Django Reuses Cached CSRF Token

    The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anon…

    python-django django python-django Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1090588
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1090592
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1090593
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0457.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0472
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0472
  • report
    https://access.redhat.com/security/cve/CVE-2014-0473
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0473
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0473
  • report
    https://access.redhat.com/security/cve/CVE-2014-0474
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0474
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0474