Description
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 1.6.6-1 | — |
| Debian 13 | python-django | 1.6.6-1 | — |
| Debian 12 | python-django | 1.6.6-1 | — |
| Debian 7 | python-django | 1.4.5-1+deb7u8 | DSA-3010-1 |
| Debian 6.0 | python-django | 1.2.3-3+squeeze11 | DLA-65-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | python-django | 1.6.1-2ubuntu0.4 | USN-2347-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | < 1.4.14 | 1.4.14 | GHSA-625g-gx8c-xcmg |
| PyPI | django | >= 1.5, < 1.5.9 | 1.5.9 | GHSA-625g-gx8c-xcmg |
| PyPI | django | >= 1.6, < 1.6.6 | 1.6.6 | GHSA-625g-gx8c-xcmg |
| PyPI | django | >= 1.7a1, < 1.7c3 | 1.7c3 | GHSA-625g-gx8c-xcmg |
| PyPI | django | < 1.4.14 · >= 1.5, < 1.5.9 · >= 1.6, < 1.6.6 | 1.4.14, 1.5.9, 1.6.6 | PYSEC-2014-6 |
Advisories 3
- DLA-65-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3010-1 python-django - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2347-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://www.djangoproject.com/weblog/2014/aug/20/security/
- 61276 third-party-advisory
- 61281 third-party-advisory
- openSUSE-SU-2014:1132 vendor-advisory
- DSA-3010 vendor-advisory
- 59782 third-party-advisory