Description
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.6.3-1 | — |
| Debian 13 | python-django | 1.6.3-1 | — |
| Debian 12 | python-django | 1.6.3-1 | — |
| Debian 7 | python-django | 1.4.5-1+deb7u7 | DSA-2934-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze10 | DSA-2934-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.1 | USN-2169-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | Django14 +1 | 1.4.11-1.el6ost | RHSA-2014:0456 |
| Red Hat OpenStack 3 | Django14 +1 | 1.4.11-1.el6ost | RHSA-2014:0457 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.4.11 | 1.4.11 | GHSA-89hj-xfx5-7q66 |
| PyPI | django | >= 1.5, < 1.5.6 | 1.5.6 | GHSA-89hj-xfx5-7q66 |
| PyPI | django | >= 1.6, < 1.6.3 | 1.6.3 | GHSA-89hj-xfx5-7q66 |
| PyPI | django | < 1.4.11 · >= 1.5, < 1.5.6 · >= 1.6, < 1.6.3 | 1.4.11, 1.5.6, 1.6.3 | PYSEC-2014-2 |
Advisories 4
- DSA-2934-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2169-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RHSA-2014:0457 Red Hat Security Advisory: Django security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2014:0456 Red Hat Security Advisory: Django security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- USN-2169-1 vendor-advisory
- https://www.djangoproject.com/weblog/2014/apr/21/security/
- RHSA-2014:0457 vendor-advisory
- 61281 third-party-advisory
- DSA-2934 vendor-advisory
- openSUSE-SU-2014:1132 vendor-advisory
- RHSA-2014:0456 vendor-advisory