Description
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.6.3-1 | — |
| Debian 13 | python-django | 1.6.3-1 | — |
| Debian 12 | python-django | 1.6.3-1 | — |
| Debian 7 | python-django | 1.4.5-1+deb7u7 | DSA-2934-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze10 | DSA-2934-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.1 | USN-2169-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | Django14 +1 | 1.4.11-1.el6ost | RHSA-2014:0456 |
| Red Hat OpenStack 3 | Django14 +1 | 1.4.11-1.el6ost | RHSA-2014:0457 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.4.11 | 1.4.11 | GHSA-wqjj-hx84-v449 |
| PyPI | django | >= 1.5, < 1.5.6 | 1.5.6 | GHSA-wqjj-hx84-v449 |
| PyPI | django | >= 1.6, < 1.6.3 | 1.6.3 | GHSA-wqjj-hx84-v449 |
| PyPI | django | < 1.4.11 · >= 1.5, < 1.5.6 · >= 1.6, < 1.6.3 | 1.4.11, 1.5.6, 1.6.3 | PYSEC-2014-3 |
Advisories 4
- DSA-2934-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2169-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RHSA-2014:0457 Red Hat Security Advisory: Django security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2014:0456 Red Hat Security Advisory: Django security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- USN-2169-1 vendor-advisory
- https://www.djangoproject.com/weblog/2014/apr/21/security/
- RHSA-2014:0457 vendor-advisory
- 61281 third-party-advisory
- DSA-2934 vendor-advisory
- openSUSE-SU-2014:1132 vendor-advisory
- RHSA-2014:0456 vendor-advisory